News for hackers. Stuff that matters.

A comment on I worked at LastPass as an engineer. My 2 cents on the situation. Parent comment

Re:I worked at LastPass as an engineer. My 2 cents on the si... by Leo_Verto on Sunday December 25, 2022 @07:55AM (#34126832)
To add onto this, the reason ECB mode is so horribly bad, is that it produces the same cyphertext for blocks with the same plaintext.

This allows an attacker to detect repeating plain text segments, e.g. reused passwords.

The Wikipedia article on block cypher modes illustrates this problem rather well [1].

[1]: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...

[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by zinekeller on Sunday December 25, 2022 @08:13AM (#34126956)
ECB Penguin! (https://words.filippo.io/the-ecb-penguin/)

Also, I've just learned that the quintessential file has been recently replaced. I understand the need for a higher resolution file, but I'm still a bit sad.

[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by evandale on Sunday December 25, 2022 @03:43PM (#34131029)
Hah, that first tweet is classic https://xkcd.com/1053/ and I'm one of the 10000 today :) Today is the first time I've seen the penguin!
[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by bbbbb5 on Sunday December 25, 2022 @10:04AM (#34127789)
>This allows an attacker to detect repeating plain text segments, e.g. reused passwords.

This is hardly a problem, any login form will also allow an attacker to do this.

[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by ilyt on Sunday December 25, 2022 @10:08AM (#34127834)
... actually that might be a "feature" for them, they do have duplicate password report, I had assumed that's just based off decrypted ones on client side but they might be just using ECB for that
[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by insanitybit on Monday December 26, 2022 @12:48AM (#34134977)
That report requires you enter your master password, so I doubt it.
[ Parent | on HN ]