Hacker News Reader

Comment by gabriel34 | Hacker News Reader

I'm no crypto or security expert, but this worries me:

   "For security, the online password databases are encrypted with client-side keys derived from your master password"

What is going on here? Does it hash my master password, generating a new pass? If so, this seems like it would only increase the number of bits in the possible keyspace but not increase the number of possible keys, while actually lowering security (since hash collisions can occur). This worries me because non-standard crypto applications tend to actually introduce holes and vulnerabilities. What other vulnerabilities lie hidden here?

View on HN

I'm no expert but I see no harm here. In order to use symmetric encryption, you need a certain key size (e.g. 128-bit key for AES-128). How do you transform a password of, say, 15 characters to 128 bits? You guessed it, with a hash (well a key derivation function to slow down brute force). What they do is I think standard practice.

> but not increase the number of possible keys

So yes, if your password is weak, then it won't make it strong.

> while actually lowering security (since hash collisions can occur)

But I think you're wrong here. On a human password of 30 bits of entropy, there is very little chance of collision. If one collision was to happen, you'd still have a key space of (30^2) - 1, which is very much the same number.

My guess is they're using the standard approach for deriving an encryption key from a password: http://en.wikipedia.org/wiki/PBKDF2

Thanks for the clarification (and thanks to throwaway above as well), seems this is standard. Is there a salt in this implementation? Is it bruteforced the first time I open the database on a new device?

It says the encryption is done client-side so a salt would be public.

edit: they may be salting with the username or email address.

Reply on news.ycombinator.com