News for hackers. Stuff that matters.

A comment on LastPass breach: The significance of these password iterations.

Re:LastPass breach: The significance of these password itera... by smoothgrammer on Wednesday December 28, 2022 @09:47PM (#34168871)
The article is missing key data. The password iterations that are set low are client side. The server side is different.

The writer of the article needs to retract.

https://support.lastpass.com/help/about-password-iterations-...

[ Parent | on HN ]
Re:LastPass breach: The significance of these password itera... by palant on Thursday December 29, 2022 @03:13AM (#34170595)
Disclaimer: I’m the author of this article.

I’m not missing anything. It’s LastPass who finally need to retract this article. I proved back in 2018 that server-side iterations are misimplemented and have no security effect. That’s why they increased the client-side value in the first place. See https://palant.info/2018/07/09/is-your-lastpass-data-really-...

[ Parent | on HN ]