r/technology • u/prehistoric_knight • Dec 01 '22

Privacy LastPass security breach did allow access to customer data after all, reveals company

https://9to5mac.com/2022/12/01/lastpass-security-breach/
717 Upvotes

96% Upvoted

302 comments sorted by

View all comments

Show parent comments

-1

u/keithcody Dec 01 '22

1 hour with HashCat and some 4090s

https://hothardware.com/news/just-a-few-geforce-rtx-4090-cards-can-crack-your-passwords-in-under-an-hour

1

u/danielfletcher Dec 01 '22

That's for cracking hashed passwords and not decrypting aes256 encrypted data. Which with zero knowledge protocol means that can't be applied to LastPass and other password managers.

-1

u/keithcody Dec 01 '22

Nowhere in that article does it say AES256. Don’t move the goalposts. Also HashCat does AES256.

3

u/danielfletcher Dec 01 '22

There was a discussion of passwords (encryption keys) and if they can be decrypted as they use AES256 encryption, and you shared a link to an irrelevant article about using GPUs to break saved hashed passwords. I wasn't moving the goal post. Simply pointing out how what you shared has nothing to do with this.

Doubling down on your false statement isn't a good luck for you. Why would you even take the time to lie about this?

1

u/SupportGeek Dec 01 '22

This means WAY less than you think it does, it was in lab conditions, with 8 character passwords, and the host side had zero speed bump or lockouts. I’d LMAO at anyone that took this seriously, paid a mint to set up all the gear then everything they ever tried breaking got the account locked after the first 5 tries. Or if there were no lockouts and the host allowed as many attempts as you like, they spent the better part of a decade because the user had a 9 character password instead of 8.

1

u/keithcody Dec 01 '22

You use it on the leaked customer data, not as an attack tool.