I worked at LastPass as an engineer (twitter.com)

Article summary

The article discusses a former engineer's experience at LastPass, a password management company, and reveals potential security issues with the company's encryption methods. The number of PBKDF2 rounds, a measure of encryption strength, is reportedly fixed at the time of account creation and not updated over time. This could leave older accounts vulnerable to brute force attacks. The article's details are not available, but the comments discuss the implications of this security issue.

Main themes

• password encryption
• security best practices
• PBKDF2 rounds
• ECB mode AES-256
• user-configurable settings
• password management companies

What commenters say

• LastPass's encryption methods are insecure due to the use of a low number of PBKDF2 rounds and ECB mode AES-256.
• The company should have increased the number of rounds over time to keep up with best practices.
• Exposing the number of rounds as a user-setting is unnecessary and may confuse non-technical users.
• The security issue could have been mitigated by silently re-encrypting the vault during login or by prompting the user to update their settings.
• Some users argue that the use of ECB mode may not be a significant issue in practice, especially if passwords are randomly generated.
• Others disagree, citing the potential for password reuse and the importance of following best practices.
• LastPass's failure to update their encryption methods over time is seen as a significant oversight and a reason to switch to alternative password managers.
• The use of user-configurable settings for encryption strength may be unnecessary and could lead to insecure configurations if not properly managed.