Conversation

I published an article on the #LastPassBreach: https://palant.info/2022/12/23/lastpass-has-been-breached-what-now/

This is very serious, no matter what #LastPass says. From the article:

“This makes it sound like decrypting the passwords you stored with LastPass is impossible. It also prepares the ground for blaming you, should the passwords be decrypted after all: you clearly didn’t follow the recommendations. Fact is however: decrypting passwords is expensive but it is well within reach. And you need to be concerned.”

Another conclusion from this article: #PBKDF2 is dead. Yes, you have that officially from me. If you still use it, feel free to go and fix that now.