Re:I worked at LastPass as an engineer. My 2 cents on the si...
by cmeacham98 on Sunday December 25, 2022 @10:36AM
(#34128080)
Knowing you reused the same password between your Amazon and $CompromisedWebsite accounts (but nowhere else, maybe you set them up the same day) gives attackers a significant advantage over having to try every password they have on every website.
[ Parent
| on HN ]
Re:I worked at LastPass as an engineer. My 2 cents on the si...
by bbbbb5 on Sunday December 25, 2022 @10:39AM
(#34128114)
I don't think this is a significant advantage, the cost of an incorrect password attempt is essentially zero. Trying "every password they have on every website" for an individual will still be a very small set of passwords to try.
Re:I worked at LastPass as an engineer. My 2 cents on the si...
by Shaanie on Sunday December 25, 2022 @10:45AM
(#34128159)
I could see password reuse being used as a reason for trying brute force/dictionary attacks. E.g. You see that a user has used the same password on Coinbase as X, which could indicate that the user isn't using randomly generated passwords and therefore be potentially vulnerable to such attacks.
Kind of a long shot though.
Re:I worked at LastPass as an engineer. My 2 cents on the si...
by cmeacham98 on Sunday December 25, 2022 @11:33AM
(#34128558)
Attackers generally aren't targeting a specific individual, they got a dump of X million passwords from some compromised website. Being able to connect those directly to working accounts rather than having to burn IPs and get them rate limited and/or banned trying duds _is_ valuable information.
If you have some attacker after specifically you, yes this information is of less use to them, because they will have tried every password of yours they have on every website already hoping you reuse passwords.