11–20 of 118 posts
Note that is NOT a demonstration of being able to crack an encrypted LastPass vault. The author's exercise wouldn't be feasible without prior knowledge of the master password, or choosing a master password that is present in a list of common passwords. That is consist with what we have heard from LastPass so far.
Looks like the XKCD way of generating passwords is not as secure. After all, it decreases entropy by a whole lot if 30 characters can be dumbed down to 5 English words with dashes/spaces/periods between. So it’s kind of like using 5 characters from a much larger alphabet (the English dictionary) instead of 30 from a 26 letter alphabet.
Even on the low end, it should take well over a decade if LastPass chose a good cryptographic hash function with a high iteration count.
The problem is that no average person is gonna use a password that long to begin with.
I was hoping for an exploration of how quickly one might crack a lastpass vault looking at different strength passwords and different iteration counts.
Instead the author has simply demonstrated that if you tell the cracking tool your password it can indeed crack it...
I guess you can at least follow what they did with your own vault without adding your password to the word list and see if it cracks quickly or not.
So, if my lastpass master password is actually secure (~30 characters and contains capital, lowercase, symbols, and a long string of randomly-generated numbers that I memorized as part of it, and no part of this is reused anywhere else), do I have to worry? It does seem like a good idea to switch, but do I have to switch urgently ?
You probably don't have to worry. The main concern is whether LastPass has also faced a supply chain attack that will expose you to a malicious client that will leak your passwords post-decryption.
Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password. I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security. The average consumer needs an autoge…
> This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password.
A bit disingenuous to not discuss the strength of his master password, but a good demonstration for some who still trust LastPass's very disingenuous communication.
The problem is that most people will choose simple master passwords. By not requiring an autogenerated secret key, LastPass prioritized ease of onboarding (=increased profits) over user security, and now the average consumer will be facing the consequences.
> I downloaded the popular rockyou.txt wordlist and put my actual vault master plaintext password inside Note that is NOT a demonstration of being able to crack an encrypted LastPass vault. The author's exercise wouldn't be feasible without prior knowledge of the master password, or choosing a master password that is present in a list of common passwords. That is consist with what we have heard from LastPass so far.
The author does point out that a 2,000,000+ hashes per second could be achieved so it might give insight into how quickly all accounts will be checked against popular word lists. If I was a last pass customer I would be thinking about changing passwords on all accounts.
Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password. I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security. The average consumer needs an autoge…
Do you know that or do you just hope they do what you think they do?
>I downloaded the popular rockyou.txt wordlist and put my actual vault master plaintext password inside I was hoping for an exploration of how quickly one might crack a lastpass vault looking at different strength passwords and different iteration counts. Instead the author has simply demonstrated that if you tell the cracking tool your password it can indeed crack it... I guess you can at least follow what they did…
It's called "dictionary attack", but author wasn't bothered doing full brute-force attack or masked attack. It's a demonstration that a laptop can reach `2,000,000+ H/s`.