Cracking encrypted LastPass vaults
markuta.com
Cracking encrypted LastPass vaults
1–10 of 118 posts
Re: Cracking encrypted LastPass vaults
#2Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password.
I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security.
The average consumer needs an autogenerated secret key. It provides entropy where the user will refuse to. Everyone I have helped set up a LastPass or Bitwarden account have chosen simple passwords, and are extremely resistant to the point of anger if you make them choose a complex one. After a few weeks, my mother changed her complex password back to a simple one behind my back - the only time she's learnt computer functionality on her own.
1Password's whitepaper, IMO, also shows that it's ahead of the game in general.
I wasn't surprised when LastPass was hacked - indeed, I've been expecting it for years - poor software quality and bad security choices were the red flags. Hopefully this forces BitWarden and LastPass to change and introduce generated secret keys in their account creation phase.
Re: Cracking encrypted LastPass vaults
#3A bit disingenuous to not discuss the strength of his master password, but a good demonstration for some who still trust LastPass's very disingenuous communication.
Re: Cracking encrypted LastPass vaults
#4Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password. I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security. The average consumer needs an autoge…
I thought 1Password and LastPass were equal. Then I was asked to use LastPass still can’t believe how crude & crap it is compared to 1Password (even before breaches.)
Re: Cracking encrypted LastPass vaults
#5A bit disingenuous to not discuss the strength of his master password, but a good demonstration for some who still trust LastPass's very disingenuous communication.
The problem is that most people will choose simple master passwords. By not requiring an autogenerated secret key, LastPass prioritized ease of onboarding (=increased profits) over user security, and now the average consumer will be facing the consequences.
Re: Cracking encrypted LastPass vaults
#6Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password. I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security. The average consumer needs an autoge…
I thought 1Password and LastPass were equal. Then I was asked to use LastPass still can’t believe how crude & crap it is compared to 1Password (even before breaches.)
[deleted]
Re: Cracking encrypted LastPass vaults
#7So, if my lastpass master password is actually secure (~30 characters and contains capital, lowercase, symbols, and a long string of randomly-generated numbers that I memorized as part of it, and no part of this is reused anywhere else), do I have to worry? It does seem like a good idea to switch, but do I have to switch urgently?
Re: Cracking encrypted LastPass vaults
#8So, if my lastpass master password is actually secure (~30 characters and contains capital, lowercase, symbols, and a long string of randomly-generated numbers that I memorized as part of it, and no part of this is reused anywhere else), do I have to worry? It does seem like a good idea to switch, but do I have to switch urgently ?
You probably don't have to worry.
The main concern is whether LastPass has also faced a supply chain attack that will expose you to a malicious client that will leak your passwords post-decryption.
Re: Cracking encrypted LastPass vaults
#9Looks like the XKCD way of generating passwords is not as secure. After all, it decreases entropy by a whole lot if 30 characters can be dumbed down to 5 English words with dashes/spaces/periods between.
So it’s kind of like using 5 characters from a much larger alphabet (the English dictionary) instead of 30 from a 26 letter alphabet.
Re: Cracking encrypted LastPass vaults
#10Looks like the XKCD way of generating passwords is not as secure. After all, it decreases entropy by a whole lot if 30 characters can be dumbed down to 5 English words with dashes/spaces/periods between. So it’s kind of like using 5 characters from a much larger alphabet (the English dictionary) instead of 30 from a 26 letter alphabet.
The XKCD method was always aware of that, the point is that it's more entropy anyway.