Hacker News Reader

Comment by idatum | Hacker News Reader

LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there".

Let's assume one's master password is strong. And that LastPass knows how to encrypt data. We're really down to whether 256-bit AES can be brute forced, right? And I guess understanding phishing attacks.

I mean, yes, wouldn't it be great of LastPass took the measures with its development environment years ago? So put another way: Lack of operational excellence hopefully is made for in strong encryption. I hope.

View on HN

    contains both unencrypted data, such as website URLs,

No I think this is the worst that could have happened short of loosing the clear-text passwords. Noone is going to stop the attackers from looking for high-value login URLs and than spear-phish the password for the offline vault.

Forcing a password reset onto customers is not going to help LastPass here.

Unfortunately, if you like me have been a LP customer for years you are hosed.

Early on, they only did 500 rounds of AES which significantly weakens you even with a strong password.

So, I've had to change my master password and now I'm in the process of updating all my passwords :(

By not forcing a re-encryption when they uped the number of rounds, LP has hung all their old time customers out to dry with this leak. It's not ok.

> LastPass is an enormous target, obviously. And, I guess, the inevitable has happened: Encrypted trove of passwords is "out there".

This is why a company’s bug bounty should be the sum of the assets protected by the data they have, for all their customers, minus $1.

Sounds crazy? Don’t store all passwords at the same place.

Reply on news.ycombinator.com