News for hackers. Stuff that matters.

A comment on Cryptopathic: The situation at LastPass may be worse than they are letting on.

Re:Cryptopathic: The situation at LastPass may be worse than... by tommieb on Saturday December 24, 2022 @04:46AM (#34115405)
What I find concerning is PKDBF was used, even https://en.wikipedia.org/wiki/PBKDF2 quotes PKDBF1 and PKDBF2,and that is recommended to use PKDBF2. Is there any evidence to show that they indeed rolled their own encryption rather than use a de-facto standard AES algorithm? Or is there something that is missing.
[ Parent | on HN ]
Re:Cryptopathic: The situation at LastPass may be worse than... by fear-anger-hate on Saturday December 24, 2022 @05:31AM (#34115634)
PKDBF is just the password derivation function to better protect the vault against dictionary attacks. The vaults are still encrypted with AES-256.
[ Parent | on HN ]