Hacker News Reader

Comment by simias | Hacker News Reader

You're right but I would like to point out that a few things actually aren't encrypted in your vault, in particular the URL field of the form. I don't really know if they mine that for info but in theory, they could. And obviously anybody having access to your encrypted blob on your filesystem can do the same.

Also, the extension queries the server to know the number of rounds to use while deriving the master key from the password before it'll deliver the encrypted blob to the client, so in theory if they really wanted to break your password they could tell the extension that it's encrypted with a single round of the hash function (IIRC the minimum is actually two) which would make bruteforcing a whole lot easier, although still very much non-trivial.

View on HN

> it'll deliver the encrypted blob to the client, so in theory if they really wanted to break your password they could tell the extension that it's encrypted with a single round of the hash function

That's incorrect. When you change the round count your master password is re-computed, and database is re-encrypted with the new hash. The server needs to return the round count so the client can generate the correct master password hash, if you ignore that and simply calculate it for e.g. 2 rounds, the master password hash won't match and therefore the AES-256 database won't decrypt.

The way Lastpass works is straightforward... PBKDF2(password, rounds) -> AES256(hash, blob). If the rounds change then the resulting hash changes and therefore the database won't decrypt. Your second paragraph is quite confusing, in that I cannot make heads or tails of why you think you can use 2 rounds when e.g. 10,000 are specified previously. A correct round count is just as vital as a correct password in generating the correct hash.

I'm talking about the authentication to the lastpass server, not the decryption itself.

Lastpass won't serve you the encrypted blob if you don't authenticate with their servers. To do this it computes a different key (using a different derivation function, but using the same "master" password as the encryption key) that it uses to log into the lastpass server.

This key cannot be used to decrypt the blob because of the different derivation function, but the client asks the server how many rounds of the kdf to use for a given user by posting its email to https://lastpass.com/iterations.php . As you can see it defaults to 5000, but the client will gladly accept any value.

Therefore the server can tell the client to send a key derived from only one iteration, it which case this code is run: https://github.com/lastpass/lastpass-cli/blob/623b344e898958...

In other words if an hostile party gets access to the lastpass server they can instruct your client to send your master password protected by two rounds of sha256. If you have a strong password (as you should) it's not an issue, but clearly you can't count on thousands of rounds of the KDF as you might think.

Reply on news.ycombinator.com