Re:LastPass: Security done wrong
by ricardobeat on Thursday March 23, 2017 @04:11PM
(#13943776)
Does using PGP make it any safer than, say, simple password-based SHA-512 encryption?
[ Parent
| on HN ]
It does. Using PGP in conjunction with a Yubikey means even if someone obtains your password repo, they still can't get in without your physical private key. Without using a Yubikey, an attacker would still need to obtain the private key. They couldn't just grab the vault from the cloud store and start running offline password cracking on it.
Re:LastPass: Security done wrong
by scott_karana on Thursday March 23, 2017 @08:52PM
(#13945677)
How do you encrypt using a hash function?...
While it can be done (use the secure hash to generate a key stream--but first google it because I bet there are some pitfalls to keep an eye on), I assume that the parent poster meant to indicate a symmetric encryption algorithm like AES (as opposed to asymmetric PGP), instead of a hash algorithm like SHA.