I worked at LastPass as an engineer. My 2 cents on the situation

Re:I worked at LastPass as an engineer. My 2 cents on the si... by brianshaler on Sunday December 25, 2022 @08:00AM (#34126872)

This is pretty wild. When you rotate your master password and it re-encrypts everything, that's a perfect opportunity to use a new iteration count. If they didn't want change the value for user's who were at an old default value, they at least could have nagged "your account is using an old/low value for an encryption setting, click here to use the latest recommended default"

Of course, changing it now won't do any good with regard to previous leaks.

[ Parent | on HN ]

Re:I worked at LastPass as an engineer. My 2 cents on the si... by insanitybit on Monday December 26, 2022 @12:45AM (#34134963)

They could have changed the setting any time the user logged in. I pointed out that they used too few rounds over a decade ago, I believe. To their credit, they increased the limit to 256K in response (it was much lower before).

[ Parent | on HN ]