91–100 of 189 posts
Earlier quoted context omitted.
This is broken thinking built on faulty assumptions. There are countless examples of massive conspiracies and secrets never leaking.
Can you provide some? I have previously only heard "santa".
Earlier quoted context omitted.
Your analysis seems to overlook an important detail in that first bullet point - dictionary attacks are only feasible when the KDF is fast. Authentication servers tend to require the KDF to be fast so they aren't constantly performing a denial of service attack on themselves. What people are looking for is a way to make the combined KDF slow by pushing most of the work to the client side. If this succeeds, you have m…
This is an interesting point. I'd be inclined to ensure that the server side hash is still at least independently expensive enough as would be desirable for plain text, but then using the client side hash to go above and beyond computationally seems reasonable to me. I would wonder though -- there's obviously a practical limit on user experience for waiting for computation, and is there really fast enough implementat…
But I can see using a split KDF for some high-security system where the clients all have a known minimum spec.
Earlier quoted context omitted.
Can you provide some? I have previously only heard "santa".
Sure, I do contracting work for the military. There are hundreds of millions of secrets kept every day with hundreds of thousands of people keeping their mouths shut. Leaking is exceedingly rare.
So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…
Earlier quoted context omitted.
Sure, I do contracting work for the military. There are hundreds of millions of secrets kept every day with hundreds of thousands of people keeping their mouths shut. Leaking is exceedingly rare.
The military has a much bigger threat of prison for yourself than a company that the investors sue
I’ve seen estimates as high as 10% of the population of east Germany were spying on their neighbors.
Earlier quoted context omitted.
Can you provide some? I have previously only heard "santa".
Sure, I do contracting work for the military. There are hundreds of millions of secrets kept every day with hundreds of thousands of people keeping their mouths shut. Leaking is exceedingly rare.
Earlier quoted context omitted.
The military has a much bigger threat of prison for yourself than a company that the investors sue
Oh absolutely. My point was strictly the assumption that many people can’t keep secrets. Depending on ideology, reprisals, or personal ethics (good and bad), secrets can be kept by a startlingly large group of people. I’ve seen estimates as high as 10% of the population of east Germany were spying on their neighbors.
So this blog seems to completely ignores LastPass statement from 2021-12-28: > Our investigation has since found that some of these security alerts, which were sent to a limited subset of LastPass users, were likely triggered in error. As a result, we have adjusted our security alert systems and this issue has since been resolved. Source: https://blog.lastpass.com/2021/12/unusual-attempted-login-ac... Source2: https:…
Earlier quoted context omitted.
Use client TLS certificates and let the browser handle credential management, including at-rest encryption. Or use FIDO2 hardware. There are many options available but for probably familiarity reasons the vast majority of users and browsers didn't go down that path, and neither did website owners.
I've only seen client certs used in contexts where an IT department assigns them to employees. Has anyone had success with these on public facing websites? Extra hardware seem cool, but I've also rarely seen people using them. I'm guessing the added cost is a deterrent.
Earlier quoted context omitted.
That statement is too squirrelly for me to trust if my passwords were stored with them. “SOME of these security alerts” “were LIKELY triggered” “HAS BEEN solved” (Emphasis mine) How can the issue be definitely solved if you aren’t sure that they were actually triggered in error, if they were in error then it’s only some of them.
It's easy for me to imagine how you get here. - Eng are still writing the postmortem - Marketing want to put out a statement - Eng know or suspect a bug exists that can trigger spurious notifications, but don't have sufficient logs to be able to reconstruct if that bug was in fact in play in production - Legal advises not to say anything definitive that they can't stand behind later I don't see any of that as particu…
What I want to know is have I been compromised or not, the PR saves face at further expense of users (if they truly have been compromised).