News for hackers. Stuff that matters.

A comment on LastPass breach: The significance of these password iterations. Parent comment

Re:LastPass breach: The significance of these password itera... by palant on Thursday December 29, 2022 @03:09AM (#34170567)
Disclaimer: I’m the author of this article.

No, the iteration count is no secret. It’s even exposed via a public API, anyone can query it if they know the email address.

[ Parent | on HN ]
Re:LastPass breach: The significance of these password itera... by robin_reala on Thursday December 29, 2022 @03:24AM (#34170650)
…why would you even do that?
[ Parent | on HN ]
Re:LastPass breach: The significance of these password itera... by palant on Thursday December 29, 2022 @03:57AM (#34170826)
The number of iterations is needed for login. The user enters their email address and password, and the app needs to know (before they actually log in) how many iterations to apply. There are approaches like the OPAQUE protocol which avoid having the iterations count in the open, but LastPass didn’t implement that. To their defense, OPAQUE is relatively new.
[ Parent | on HN ]
Re:LastPass breach: The significance of these password itera... by AdmiralAsshat on Thursday December 29, 2022 @12:07PM (#34174812)
Well, balls. Thanks for confirming.
[ Parent | on HN ]