News for hackers. Stuff that matters.

A comment on I worked at LastPass as an engineer. My 2 cents on the situation. Parent comment

Re:I worked at LastPass as an engineer. My 2 cents on the si... by eternityforest on Sunday December 25, 2022 @08:34AM (#34127102)
How is AES ECB even possible? You would have to actively choose to do that. It's more effort than something like libsodium.

Have they not heard of the first rule of crypto being "You probably aren't qualified to do it, use libsodium or TLS or SSH" yet? Why are they messing with cipher modes themselves?

[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by tptacek on Sunday December 25, 2022 @10:32AM (#34128057)
Their encryption code predates libsodium, and ECB was (on many platforms still is) the default mode --- also, the only mode that doesn't require confusing extra parameters.
[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by eternityforest on Sunday December 25, 2022 @12:31PM (#34129101)
It's an utterly useless mode though unless you add your own confusing extra stuff. It was probably a bad plan to make that the default.
[ Parent | on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si... by insanitybit on Monday December 26, 2022 @12:51AM (#34134999)
People forget that:

a) LastPass is extremely old

b) Browser extensions used to be completely different. You needed to call out to native code to do tons of stuff because the JS apis were extremely limited and slow. So it was either "roll crypto in JS" or "make users install a binary", the latter stopped being possible over something like a decade ago.

[ Parent | on HN ]