Security researcher weighs in on LastPass’ security breach and it’s not good


Following a security breach not too long ago, LastPass recently updated its users where they revealed that hackers had managed to get their hands on a backup of the password vault belonging to its users.

This is probably one of the worst things that could happen, but according to LastPass, the encryption and security protocols they employed mean that the hackers would have an incredibly tough time breaking in, or could they? That’s not what security researcher Wladimir Palant thinks in his blog post on his website where he claims that it could be much worse than we thought.

In his post, he points at specific points in LastPass’ statement, such as how  the company claims it would take “millions of years” to guess your master password, but in reality, it could only take as little as two months, and that it would only take the hacker a single GPU to crack it. Assuming the hacker had access to more powerful hardware, presumably this would reduce the amount of time.

“I’ll translate: “If you’ve done everything right, nothing can happen to you.” This again prepares the ground for blaming the customers. One would assume that people who “test the latest password cracking technologies” would know better than that. As I’ve calculated, even guessing a truly random password meeting their complexity criteria would take less than a million years on average using a single graphics card.

But human-chosen passwords are far from being random. Most people have trouble even remembering a truly random twelve-character password. An older survey found the average password to have 40 bits of entropy. Such passwords could be guessed in slightly more than two months on the same graphics card. Even an unusually strong password with 50 bits of entropy would take 200 years on average – not unrealistic for a high value target that somebody would throw more hardware on.”

So what does this mean for users? Basically you should go and change all the passwords in your vault, especially for more important accounts like that of your bank, emails, and so on. Depending on how many passwords you’ve stored, it could take a while, but it’s better to be safe than sorry!

Source: 9to5Mac

Tyler Lee
A graphic novelist wannabe. Amateur chef. Mechanical keyboard enthusiast. Writer of tech with over a decade of experience. Juggles between using a Mac and Windows PC, switches between iOS and Android, believes in the best of both worlds.

    LG’s new telephoto camera module will bring better zoom to our smartphones

    Previous article

    DEAL: The Ecovacs Deebot X1 Omni is enjoying a crazy discount you don’t want to miss

    Next article

    You may also like


    Leave a reply

    Your email address will not be published. Required fields are marked *

    More in News