Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cracking encrypted LastPass vaults

markuta.com

Post reply on HN
Print view View original

41–50 of 118 posts

Re: Cracking encrypted LastPass vaults

#41

Post by PuffinBlue »

pecheny wrote: post #33
selykg wrote: post #23

Earlier quoted context omitted.

With 1Password you also have a randomly generated secret key. As I recall it’s a 128-bits, but could be wrong. To access your vault an attacker will need both your master password and the secret key. These are effectively combined to generate your keys for decryption. This protects against an attacker gaining access to 1Password servers. They can’t control whether you chose an awful password or not. So to protect the…

Sorry, I don't get it. The secret key has to be stored somewhere, right? If it's on the server, the attacker gets it together with the vault. If it's on the client, then you lose your phone → you lose your passwords, which is, while secure, very risky and I wouldn't expect it from a company focused on regular customers.

When you setup your 1password account you are provided an ‘Emergency kit’ in the form of a PDF containing this key and other info. You are supposed to save it somewhere secure or print it and place it somewhere secure.

You could save it in a local keepassXC database if you like.

This 128bit key is only saved locally, not on their servers. So contrary to you disbelief, 1Password does actually prioritise security in this manner over focusing on ‘regular customers’.

Its also fairly common to have more than one device, so you would have the key on more than one device as a result too.

Re: Cracking encrypted LastPass vaults

#42

Post by sinuhe69 »

There is always a potentially critical vulnerability in any centralized password storage. Especially, if it requires a (relatively) simple master password to access. A many factors system like the one of Apple is IMO more secure but also easier to remember because they are all pin/passwords one needs (almost) every day.

Re: Cracking encrypted LastPass vaults

#43

Post by daneel_w »

xvector wrote: post #12
alin23 wrote: post #9

Looks like the XKCD way of generating passwords is not as secure. After all, it decreases entropy by a whole lot if 30 characters can be dumbed down to 5 English words with dashes/spaces/periods between. So it’s kind of like using 5 characters from a much larger alphabet (the English dictionary) instead of 30 from a 26 letter alphabet.

The English dictionary has about 170k-1M words, and taking the log_2 of that gives us about 16-20 bits of entropy per word. Depending on implementation, we have anywhere from 80 to 100 bits of security. Even on the low end, it should take well over a decade if LastPass chose a good cryptographic hash function with a high iteration count. The problem is that no average person is gonna use a password that long to begin…

People using this scheme for memorable passwords will be sticking to a very narrow set of words. There are several psychological factors that can be exploited here. It's not a good password scheme unless you aim for 7-8 words minimum.

Re: Cracking encrypted LastPass vaults

#44

Post by taneq »

alin23 wrote: post #9

Looks like the XKCD way of generating passwords is not as secure. After all, it decreases entropy by a whole lot if 30 characters can be dumbed down to 5 English words with dashes/spaces/periods between. So it’s kind of like using 5 characters from a much larger alphabet (the English dictionary) instead of 30 from a 26 letter alphabet.

XKCD isn't saying that four dictionary words strung together is as strong as a 30-character random password. He's saying they're better than an 8-character password which must include at least one upper case and one lower case letter, one number, one symbol, one loud bird call and one soft squirrel noise.

Re: Cracking encrypted LastPass vaults

#45

Post by sylens »

jalapenos wrote: post #39

> otherwise it would take 6 hours+ to crack Ok, can you run it for 7 hours without your password in the list and let us know?

That did stand out to me as a pretty small amount of time to not just let it run normally

In my pentesting days if we dumped the DC at the beginning of a test we would let that run in our password cracker GPU machine for days to see what hits we got

Re: Cracking encrypted LastPass vaults

#46

Post by ketzu »

xvector wrote: post #5
gillesjacobs wrote: post #3

A bit disingenuous to not discuss the strength of his master password, but a good demonstration for some who still trust LastPass's very disingenuous communication.

The problem is that most people will choose simple master passwords. By not requiring an autogenerated secret key, LastPass prioritized ease of onboarding (=increased profits) over user security, and now the average consumer will be facing the consequences.

> LastPass prioritized ease of onboarding (=increased profits)

or (=increase number of users actually using a password manager)

Re: Cracking encrypted LastPass vaults

#47

Post by imiric »

xvector wrote: post #2

Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password. I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security. The average consumer needs an autoge…

So your more secure solution involves using... another, stronger, password? How would your mother use 1Password if she now has to remember _two_ passwords?

Both LastPass and Bitwarden (and 1Password) support 2FA. This isn't a solution that will have mass adoption, but the UX is much better and more secure than using a secret key. It could even be used by non technical users, depending on the device.

But password managers aren't a solution for digital identity. They're a hassle to use and a huge security risk, especially centralized ones. What we need is a solution that is more secure, but crucially also easier to use. The industry has been trending towards passwordless solutions for years now (OTP, FIDO, WebAuthn, etc.), and the current passkey iteration by Google might be something that could have mass adoption. Assuming you trust Google, but the technology seems sound.

We still might want to use secure storage for other data, but that's a much more niche use case that can be secured with existing MFA solutions, and doesn't have to be as user friendly as identity management.

Re: Cracking encrypted LastPass vaults

#48

Post by t0mas88 »

sigmoid10 wrote: post #30
agilob wrote: post #20

Earlier quoted context omitted.

> if you tell the cracking tool your password it can indeed crack it... It's called "dictionary attack", but author wasn't bothered doing full brute-force attack or masked attack. It's a demonstration that a laptop can reach `2,000,000+ H/s`.

>It's a demonstration that a laptop can reach `2,000,000+ H/s`. No, the author says their laptop only reaches ~1kH/s. That 2 million number is a pure guess for a multi-gpu setup and that is still pretty weak, unless you have a very good dictionary for a specific target. Brute forcing remotely long alphanumeric passwords is out of the question. So if you have a 8+ character password with upper+lowercase characters and…

With 8 characters, which is way below all recommendations and using only alphanumeric + the simple special chars on the keyboard you're looking at over 7 * 10^14 possibilities.

If you could do 100 million hashes per second (that seems to be possible with hardware looking at crypto stuff), the way I understand the setup you're still up against the 100100 iterations in the key derivation algorithm. So that's 7 * 10^19 hash calculations.

Even with the hardware to do 100 million hashes per second you're looking at nearly 23,000 years.

Let's hope you get a hit at 50% of the space (the expected average case). That's 11500 machine years with beefy GPU accelerated machine. So to bring this to a usable 5 years (and that's already pushing the expiration date of any creditcard you may find in the stolen vault) you'd need 2300 gpu accelerated machines running 24x7.

In AWS terms, with reserved discounts and everything you're going to spend roughly 60 million dollars cracking one vault.

Re: Cracking encrypted LastPass vaults

#49

Post by massysett »

ketzu wrote: post #46
xvector wrote: post #5

Earlier quoted context omitted.

The problem is that most people will choose simple master passwords. By not requiring an autogenerated secret key, LastPass prioritized ease of onboarding (=increased profits) over user security, and now the average consumer will be facing the consequences.

> LastPass prioritized ease of onboarding (=increased profits) or (=increase number of users actually using a password manager)

1Password has a solution that is quite usable: it generates a secret key and provides facilities to transfer it between hardware devices as needed, e.g. from your phone to desktop. 1Password does not cloud store it and urges users to print a backup copy.

There is a marginal usability benefit to LastPass’s lack of such facilities, but I think this breach shows that the security reduction was too high a price to pay for it.

Post reply on HN