Lastpass customer vaults taken in last attack.

[callthatgirl]

Last pass still makes me more money sadly. Passwords are never updated as clients hope, so we spend more time fiddling with last pass and then give up and reset it.

I'm still using notepad lol

 

[frase]

Excel's defenses are a joke.

We just took over a customer, the previous IT company left an Excel sheet on their domain controller that looked interesting, I cracked it using the above process and POOF every admin password to every firewall, switch, and server all mine.

Now, I had domain admin for the server, and could get to the file. So you do have some mitigating control if you can retain the access to the file itself. But if someone ever gets a copy of that sheet, the encryption is not helpful.

I am not one to be targeted for ransom, I am not on a domain controller or within a domain, I am a one person business. I would never allow my security information to be available to a service on the internet, as all security is able to be bypassed. As I said there would be no reason as to why a hacker or whatever one wishes to define them as, would target a one person business unless I opened the door for them. There is no real potential for $$$. I keep the sheet on my system for reasons being I have so many passwords, these are not for businesses I manage. For businesses I manage I create documentation in a folio with all other relevant information regarding their I.T infrastructure and they keep the documentation.

 

[britechguy]

I said there would be no reason as to why a hacker or whatever one wishes to define them as, would target a one person business unless I opened the door for them. There is no real potential for $$$.

That's what it boils down to. The proverbial juice has to be worth the squeeze.

Script kiddie hackers aren't the threats I concern myself with because the defenses I use have proven, over the course of decades, to either be beyond what they can break through or, more likely, they're just not interested. This class of hacker does "smash and grab" stuff only, and if they can't easily smash, they can't easily grab.

Operators who are looking for big money aren't interested in me, at all. They spend months to years very carefully planning and plotting their strategies and picking their targets. Social engineering is almost always involved as well.

I do use a password manager, Password Safe, and my encrypted vault is stored on Google Drive so that I have access to it on all of my laptops and my smartphone. It has served me well for heading into 20 years. Unless someone were to somehow guess my vault's master password, which at 13 characters is very unlikely, having that file is not of any use whatsoever.

 

[Sky-Knight]

SMBs are the current focus of threat actors precisely because of this attitude.

Still, the way in is still the Trojan horse, you have to click on something you shouldn't, and if that mistake is ever made you'll never have an issue. If you do have an issue however, you'll find the automation quite impressive.

The modern threat landscape targets all, there is no minimum safe size. Not anymore.

 

[frase]

In the end the problem lies with the end user, no-one can firewall stupidity.

 

[timeshifter]

Why on Earth would you give all your passwords to an online company that can be hacked at any time?

Nobody is doing that. That's not how password managers work. The most high profile example of a password manager "breach" was of LastPass a couple of years ago. While it made headlines no one's passwords were exposed. LastPass uses a zero‑knowledge architecture and AES-256 encryption, where decryption requires the user’s master password—which LastPass does not store.

 

[Sky-Knight]

Nobody is doing that. That's not how password managers work. The most high profile example of a password manager "breach" was of LastPass a couple of years ago. While it made headlines no one's passwords were exposed. LastPass uses a zero‑knowledge architecture and AES-256 encryption, where decryption requires the user’s master password—which LastPass does not store.

LastPass made the news because their infra was breached, and entire vaults were stolen.

With direct access to the encrypted blob that is your vault, there is no longer any limit on the brute force attempts, which means each vault is only as secure as the master password that was used to encrypt it and how much GPU power the attacker has to throw at it.

Some of these vaults have passwords so short a single GPU can bust them open in a matter of hours.

That's why my concerns aimed at the key iterations, because they also impact that delay.

If you're going to use PBKDF2 SHA-256 for your KDF algorithm, and you aren't going to iterate your KDF Iterations over time, you're simply not maintaining the technology. OWASP wants us to move to Argon2id, and for decent reasons. PBKDF2 is CPU bounded, Argon2id is CPU and RAM bounded, the latter of which grows much more expensively on the GPU tree!

@GTP One of the reasons I love Bitwarden so much is I can self host the vault, and of course if you don't want any commercialization at all you can jump to the FOSS VaultWarden. I know people that can only save their vaults when they get home, because the vault lives there. I've been torn on that idea personally, the balance of convenience vs risk in this space is quite the brain twister.

 

[timeshifter]

The “hours to crack” scenario only applies to people who chose weak master passwords — dictionary words, seasonal patterns, etc. — and in those cases, yes, an attacker with GPUs and the stolen vault could succeed in days. But for anyone who used a proper 12+ character high-entropy password or passphrase, the math makes brute force astronomically infeasible.

And honestly, if someone was storing high-value targets like crypto keys, banking, or government secrets behind a weak, guessable master password, that’s not on LastPass — that’s on them. Weak password practices have always been the real vulnerability here.

 

[britechguy]

dictionary words

I've never understood why these are considered so bad, provided that we're not talking dog, automobile, maple, or some similarly simple and common dictionary word.

If someone were using, for example, 'subterranean' or 'sesquipedalian' or 'otoacoustic', I don't see how those would be any more "guessable" via brute strength techniques than 'ouijaplanchette' would be, which is two dictionary words, and related ones, concatenated. It's length (that is, complexity) that's the primary determinant in making passwords difficult to crack. Brute force cracking isn't going through the dictionary word by word trying them all. I find it really weird that when I check 'subterranean' that many password checkers say it's more secure at 11 characters, without the terminal n, than with. The same is happening with 'otoacoustic,' yet all 5 testers I've used declare that 'sesquipedalian' is ultra-strong, taking on the order of years to crack, and it is absolutely a dictionary word.

I still encourage my clients to make portmanteaus with digits, something they know that's distinctive to them for each password (and usually somehow related to what it's for, however tangentially), and at least 1 special character. Using something like 1365VisaCard1* for a password, even at visa.com, is not easily guessable by any technique. And if you mix it up, Visa1365Card1*, as some people choose to, it becomes even less so (though I'd be willing to bet I'll be in my grave before anyone or anything brute force "guesses" the first version). And most of us don't have Visa cards where "visa.com" is where we would be logging in to access the account. It's to the issuer's site.

 

[Philippe]

Brute force cracking isn't going through the dictionary word by word trying them all.

Yes it is

 

[timeshifter]

Using something like 1365VisaCard1* for a password, even at visa.com, is not easily guessable by any technique. And if you mix it up, Visa1365Card1*, as some people choose to, it becomes even less so (though I'd be willing to bet I'll be in my grave before anyone or anything brute force "guesses" the first version). And most of us don't have Visa cards where "visa.com" is where we would be logging in to access the account. It's to the issuer's site.

How long would it take to brute-force this password? 1365VisaCard1*

ChatGPT said:​

Short answer: likely minutes to hours on a modern GPU using dictionary+rule attacks (not full brute force).

Why: VisaCard is a common word pair; prefixes/suffixes like 1365 and 1* are textbook mutations crackers try early. With offline access to the vault hash, tools like Hashcat will run wordlists + mangling rules that cover this pattern very quickly.

If you want this to be strong, switch to either a truly random 16+ char string or a 4–5 word unrelated passphrase (not payment/brand words) with a non-obvious separator.

 

[seashore]

We've been here a few times before: https://www.technibble.com/forums/threads/thats-some-password-security-man.91047/post-764734

My usual example shows long and easily memorable dictionary word phrases succeed every time:

thisismyverysafeunguessablepassword

Perplexity.ai says:

• Your password, at 34 lowercase characters, has 26342634 possible combinations. Even at 164 billion guesses per second (a high-end GPU’s speed), it would take longer than the age of the universe to brute force it.

 

[britechguy]

We've been here a few times before

That's putting it mildly. And your example proves the basic principle that it's length (AKA complexity) that's the primary determining factor.

If I can get people to use separate passwords, and at least 10 characters long, that's a major victory in my book.

The kind of brute force hacking that would be applied on a trove of password vaults, with a probability of uncovering a number of high value targets, is many orders of magnitude over the "smash and grab" that typifies amateur hackers.

And when it comes right down to it, brute force attacks are not of any concern to me, personally, at all nor do I think they're of concern to most of my client base. I don't care how many times certain others say otherwise, criminals, the really good ones, are not indiscriminate, but targeted. I just don't matter, most (probably all) of my clients just don't matter, because there's just not enough "juice" to be worth any substantial "squeeze."

I care about what actual users can and will realistically do, not what's theoretically the best thing to do, or even the right thing to do. The perfect is the enemy of the good (or good enough) in virtually every case.

 

[Sky-Knight]

Many of you have never known what a rainbow table is... and it shows.

That being said, length > complexity in terms of getting the required entropy.

@timeshifter You aren't wrong, but when you're paying for a service that manages passwords, you should expect them to make some sort of alert when things get blow a safe threshold based on today. Otherwise, life goes on and these things remain unnoticed. Last Pass is supposed to be the master of password management, not simply a hosting provider for a service. The same holds true of Bitwarden and all the rest.

Every year that passes, the length of the password must increase to keep the threat under control. Which is why FIDO2 keys and passkeys are the future.

 

[britechguy]

Many of you have never known what a rainbow table is... and it shows.

And you toss this stuff out as though everyone should, but never, ever give a linked reference. Here's a Perplexity.ai search on: what is a rainbow table cybersecurity
Two critical bits from the above:

1. However, modern security defenses like salting—adding unique random data to each password before hashing—render rainbow table attacks ineffective. Salting ensures that even identical passwords will have different hashes, making it impossible to use the same precomputed rainbow table across multiple accounts or systems.

2. These attacks are less effective today due to widespread adoption of salting.

Cybersecurity is now, and always has been, a game of "spy versus spy." Every attack surface (at least so far) ends up becoming useless because the defenses against it become ubiquitous, or close to it, and the next compromise method needs to be developed.

'Twas ever thus, 'twill ever be, and none of us has any real control over that. But those who specialize in cybersecurity tend to "patch the holes" on a constant, ongoing basis. What was a major threat last month can become "a big nothingburger" next month. I've watched that cycle repeat itself many, many times since entering computing in the 1980s.

 

[xrobwx71]

I am studying for the CompTIA Security+ Exam and came across Rainbow Table Attacks in the "different types of attacks" section.

I had heard of it before as I've been interested in Cybersecurity for years, but didn't fully understand the nuance.

 

[Sky-Knight]

And you toss this stuff out as though everyone should, but never, ever give a linked reference. Here's a Perplexity.ai search on: what is a rainbow table cybersecurity
Two critical bits from the above:

1. However, modern security defenses like salting—adding unique random data to each password before hashing—render rainbow table attacks ineffective. Salting ensures that even identical passwords will have different hashes, making it impossible to use the same precomputed rainbow table across multiple accounts or systems.

2. These attacks are less effective today due to widespread adoption of salting.

Cybersecurity is now, and always has been, a game of "spy versus spy." Every attack surface (at least so far) ends up becoming useless because the defenses against it become ubiquitous, or close to it, and the next compromise method needs to be developed.

'Twas ever thus, 'twill ever be, and none of us has any real control over that. But those who specialize in cybersecurity tend to "patch the holes" on a constant, ongoing basis. What was a major threat last month can become "a big nothingburger" next month. I've watched that cycle repeat itself many, many times since entering computing in the 1980s.

AI is a wonderful tool, but it's leading you astray here. It's not... wrong... but it's not right either.

When discussing cryptographic security around passwords, it's important to distinguish between hashing and encryption, as they serve very different purposes.

• Salting is used when storing password hashes in identity systems like Active Directory or Entra ID. It protects against precomputed attacks such as rainbow tables by ensuring that identical passwords produce unique hashes. These get used during the identity process, and ensure these hashes are unique even if the passwords are not.
• Initialization Vectors (IVs) are used in symmetric encryption algorithms like AES-256. They ensure that encrypting the same plaintext with the same key yields different ciphertexts, which is critical for securing encrypted blobs like password vaults.

Understanding these concepts requires a solid foundation in cryptography. If you're serious about mastering this, I highly recommend formal study college-level coursework or reputable certifications because the field is deep and nuanced. You want a source? Start here: https://www.amazon.com/Official-ISC-CISSP-CBK-Reference/dp/1119789990

Also, while rainbow tables can be effective against poorly configured authentication services, they’re far less useful against modern web services that implement proper hashing and salting techniques.

Which again is why the LastPass breach was such a big deal the encrypted blobs themselves were taken. Attackers didn’t just get metadata or credentials; they obtained vault copies containing the sensitive data. Even though the blobs were encrypted, the compromise of vaults meant that any weaknesses in key derivation, password strength, or vault configuration could be exploited over time, with no limits on the volume of computational power thrown at them.

So yes, they are one Rainbow Table away from being opened. And yes, the software vendor should have demanded better default configuration over time to protect their customers. The maintenance of the accessing identity is always on the vault's owner, but the service itself is always the provider. This is how SaaS operates.

This is not spy vs spy. This is math and responsibility.

I take that back, this is spy vs spy. Because humans insist on trusting organizations that have proven they are structurally not to be trusted. See LastPass, and CrowdStrike. But also Google, Amazon, Microsoft, and most others too. It's all degrees of course, the nuance matters.


Tangentially related topic:

It's also several levels of nerd that I love a bit too much, here have some post quantum crypto: https://pq-crystals.org/index.shtml

Because we've got StarWars and StarTrek people in the same group, doing different things, to figure out how to keep us private in a post quantum world and I'm ALL over it.

 

[britechguy]

@Sky-Knight

First, thanks for the additional clarifications and information sources. These are always welcome.

The above being said, and sincerely meant, I do believe you're missing my central point. We, each of us, have to make decisions and recommendations based on real-world conditions "on the ground" and in light of the circumstances that we know prevail. What we'd like them to be is often entirely divorced from what might be the ideal, and nothing whatsoever that we can do will move the needle significantly toward that ideal. But what we often can achieve is incremental improvement.

I work with people, and what they can do and will do is what ultimately determines what will be done. Even if that's "worst practice" rather than "best practice." I always know that I'm aiming to be as far away from the former, and as close to the latter, as I can get things, but that's often still very, very far from best practice.

With regard to your observation about the AI answer being, "not... wrong... but it's not right either," that's the nature of imperfect knowledge. On that subject, there are two quotations I love:

Life is the art of drawing sufficient conclusions from insufficient premises.
~ Samuel Butler, 1835-1902

I prefer true but imperfect knowledge, even if it leaves much undetermined and unpredictable, to a pretense of exact knowledge that is likely to be false.
~ F.A. Hayek

I am not, and will never be, a security expert or an expert on cryptography, and at my age, I have no interest in being either. I need to know enough to make reasonable decisions for the client base I have and their circumstances. What's appropriate for them is almost certainly much more simplistic than what's appropriate for your client base, and that's entirely predictable. There is no "one size fits all" nor one perfect option. There is a "good enough for the intended purposes" option for virtually any practical circumstance. That's what my focus is on.

 

[britechguy]

Additional note, which applies to not only computing, but pretty much everything in life where a simple, declarative statement doesn't cover it:

A sensible person realizes that all principles that can be expressed in a statement of finite length are oversimplified.
~ Robert Heppe

 

[Sky-Knight]

The only message I want to convey in this case is passwords suck, they've always sucked, and they only continue to suck more with time.

Password Managers are basically a requirement at this point, but they represent a stop gap measure on the way to proper authentication. Proper authentication will have to convert to, something we have, and something we are. The something we know thing we've been living and dying on will be used to unlock the thing that we have. (People are exploring e-tattoos for this, I'm not a fan)

In the meantime, capitalistic systems only care about cash unless they're forced to do otherwise. And the entire SaaS model dies, if we do not hold the operators responsible for their end of the bargain. One of the reasons I'm so Microsoft aligned is because Microsoft understands this, at least on some levels. https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility