Replying to
@epixoip@infosec.exchange 100,100 rounds is a new default. Many old accounts have the rounds set to 5,000.
Remote
Alex Coventry
@alx@mastodon.mit.edu
mastodon 4.6.9Don't infer my opinions from my boosts/Likes, and don't infer anything beyond my personal view from my Toots. Follow me if you want to live.
𝑁’𝑎𝑡𝑡ℎ𝑖 𝑠𝑎𝑛𝑡𝑖 𝑝𝑎𝑟𝑎𝑚 𝑠𝑢𝑘ℎ𝑎𝑚
131 Followers
534 Following
9 Posts
Joined April 25, 2017
Location::
Not coming, or going, or staying in place
Replying to
@HamAndChris@hachyderm.io @epixoip@infosec.exchange's link from 2015 quotes a LastPass blog post claiming "LastPass strengthens the authentication hash with a random salt and 100,000 rounds of server-side PBKDF2-SHA256, in addition to the rounds performed client-side." So it's a pretty explicit claim, and despite their security failures it seems unlikely they would have weakened that setting since. FWIW.
@thomasfuchs@hachyderm.io It's also a category error to equate contemporary LLMs with all possible future AI systems. I'm with you on your skepticism regarding the reasoning capabilities of contemporary LLMs, though.
Replying to
@yeleek@infosec.exchange
...failures, which suggests that more and more serious failures will come to light regarding LastPass's handling of people's passwords.
There is not much to recommend Bitwarden over LastPass at this stage, other than that 1) It's open source, so its handling of encrypted passwords is easily auditable and 2) so far they haven't screwed up in the ways LastPass has. To me, those are compelling reasons to move away from LastPass to *something* else, though.
@apicultor@hachyderm.io @epixoip@infosec.exchange
Replying to
@yeleek@infosec.exchange
LastPass has probably leaked an encrypted copy of your "vault" of passwords, the latest in a string of LastPass security failures. Using a yubikey does not defend you against this. In addition, LastPass's encryption method may allow attackers to try encryption keys for your vault much faster than the current state of the art would allow. In addition, they failed to encrypt metadata associated with your passwords These are serious design and operational...
@apicultor@hachyderm.io @epixoip@infosec.exchange
@thomasfuchs@hachyderm.io OK, but "It's a category error to assume AI will ever be able to write complex software" is going to look a bit silly if a system capable of writing complex software comes along. 🙂
@emptywheel@mastodon.social has uncovered evidence that someone may have been impersonating Hunter Biden, or adding fake data to his electronic records.
https://www.emptywheel.net/2023/07/16/hunter-bidens-uber-connection-and-the-k-street-collision/
@scottmstedman@journa.host Perhaps someone explained to him that without independent air support any assault on Moscow is doomed.