![]() ![]() Gosney, a password security expert at Stricture Group, wrote: He paid particular attention to the 100,000-round hashing routine, which he said was among the strongest he has ever seen. He based his assessment on the LastPass response to the breach and the system that was in place when it happened. Update: In an e-mail to reporters, Ars resident password expert Jeremi Gosney said the real-world risks the breach posed to end users was minimal. Further compounding the password predicament are studies showing vulnerabilities in specific password managers that make it possible for attackers to obtain vault contents. ![]() As Ars has long documented, the risks of using no password manager at all are also significant. Then again, end-user computers are also notoriously easy to compromise, making it hard to argue there's any safe haven for such sensitive data. Even when those passwords are robustly protected, as they appear to have been by LastPass, many experts say the cloud remains an unsuitable storage environment given the vulnerability of Internet-facing servers. Advertisementįurther Reading Why passwords have never been weaker-and crackers have never been strongerThe hack is sure to reopen the age-old debate about the wisdom of storing dozens or possibly hundreds of passwords in the cloud. Information at risk, the researcher said, included e-mail addresses, password reminders, the list of sites users logged into, and the time, dates, and IP addresses of those logins. That same year, a security researcher reported finding a cross-site scripting (XSS) bug on the LastPass website that he said made it possible for attackers to steal sensitive user data. The data that may have been accessed in that 2011 event included hashed passwords, the underlying cryptographic salts, and user e-mail addresses. The breach comes four years after LastPass officials detected anomalies in their server logs that were consistent with a network compromise. LastPass users who haven't already done so should strongly consider enabling multifactor authentication. As an added precaution, LastPass is also prompting users to update their master passwords. To prevent such attacks, LastPass officials are requiring all users who log in from new devices or IP addresses to first verify their account by e-mail unless they have multifactor authentication enabled. Despite the rigor of the LastPass hashing regimen, the job of cracking a single hash belonging to a specific, targeted individual would be considerably less difficult and potentially within the ability of determined attackers, especially if the underlying password is weak. ![]() This additional strengthening makes it difficult to attack the stolen hashes with any significant speed."īy contrast, many sites have used extremely fast hashing algorithms that provide minimal protection. "LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side. "We are confident that our encryption measures are sufficient to protect the vast majority of users," Siegrist wrote. That's because the master passwords that unlock those vaults were protected using an extremely slow hashing mechanism that requires large amounts of computing power to work. It emphasized that there was no evidence the attackers were able to open cryptographically locked user vaults where plain-text passwords are stored. Further Reading Why LivingSocial’s 50-million password breach is graver than you may thinkIn all, the unknown attackers obtained hashed user passwords, cryptographic salts, password reminders, and e-mail addresses, LastPass CEO Joe Siegrist wrote in a blog post. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |