Untitled attachment

Notices where this attachment appears

1. Yellow Flag (wpalant@infosec.exchange)'s status on Saturday, 24-Dec-2022 03:52:42 JST Yellow Flag

   I published an article on the #LastPassBreach: https://palant.info/2022/12/23/lastpass-has-been-breached-what-now/

   This is very serious, no matter what #LastPass says. From the article:

   “This makes it sound like decrypting the passwords you stored with LastPass is impossible. It also prepares the ground for blaming you, should the passwords be decrypted after all: you clearly didn’t follow the recommendations. Fact is however: decrypting passwords is expensive but it is well within reach. And you need to be concerned.”

   Another conclusion from this article: #PBKDF2 is dead. Yes, you have that officially from me. If you still use it, feel free to go and fix that now.