Re:I worked at LastPass as an engineer. My 2 cents on the si...
by IgorPartola on Sunday December 25, 2022 @10:11AM
(#34127860)
I think it should allow you to change the schedule on which it increases the rounds, not set the actual number. It should tell you how many rounds it currently is at and how it will increase but the setting most people will want is High Security, Very High Security, Ludicrous Security.
Re:I worked at LastPass as an engineer. My 2 cents on the si...
by mfer on Sunday December 25, 2022 @11:22AM
(#34128463)
Having the controls is great if you’re a technical person who knows what to do with them.
99.9%+ of people aren’t that technical person. Safe defaults need to be used and kept up to date for them.
Keep in mind that this is a trade-off, it requires more computational power AND battery, so giving users access to the leavers makes sense (e.g. power users with nice equipment can pump up the number).
That being said I do agree that it is up to the vendor to set AND enforce a new higher minimum. If someone logs in with 5K rounds, it should be changed to the new default (100k).
On a related note Bitwarden also allows users to configure this. I recently increased mine to 150K rounds.