Light

Episode #905 Quiz

1
Date: 2023-01-10 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Rob Woodruff’s PowerShell GUI deobfuscates LastPass XML vault exports, revealing cleartext URLs and flags ECB-encrypted entries. Listener discoveries showed many accounts still used PBKDF2 iteration counts of 1, 500, or 5,000. With known metadata, attackers can prioritize weak vaults; low iterations plus GPU cracking can expose passwords, notes, and identities.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what is the practical effect of leaving a LastPass account’s PBKDF2 iteration count set to 1 after the breach data was stolen?

Question 1

According to the episode, what is the practical effect of leaving a LastPass account’s PBKDF2 iteration count set to 1 after the breach data was stolen?

It leaves the vault at about 61.56 seconds to crack with 200 GPUs against a 40-bit password. It leaves the vault at about 71.338 days to crack with 200 GPUs against a 40-bit password. It leaves the vault at about 200 years to crack with one GPU against a 50-bit password. It leaves the vault at about 3.4 x 10^38 guesses to crack regardless of password strength.

Question 2: What did Rob Woodruff’s PowerShell tool reveal about LastPass vault entries, beyond merely exporting the vault data?

Question 2

What did Rob Woodruff’s PowerShell tool reveal about LastPass vault entries, beyond merely exporting the vault data?

It reconstructed missing secure notes from LastPass server-side backups using browser cookies. It flagged ECB-encrypted records and deobfuscated the stored URLs from hex to ASCII. It recovered the user’s PBKDF2 iteration count from the encrypted vault contents themselves. It decrypted the vault’s master key using the user’s email address and password.

Question 3: Which metadata did Steve say was visible in the HTML output from the deobfuscator, in addition to the logon URLs?

Question 3

Which metadata did Steve say was visible in the HTML output from the deobfuscator, in addition to the logon URLs?

The vault’s master password hint and recovery question answers. A Last Touched field showing when the last logon at that domain occurred. The user’s email address and the PBKDF2 iteration count used for that vault. The AES key material used to encrypt the record and the HMAC of the vault file.

Question 4: How did Steve characterize LastPass’s handling of users whose iteration count had remained at 1 for years?

Question 4

How did Steve characterize LastPass’s handling of users whose iteration count had remained at 1 for years?

He said LastPass should have proactively raised it over time and that leaving it at 1 was unconscionable. He said LastPass had already automatically raised every old account to 100,100 and only the UI still showed 1. He said the issue could not have been fixed transparently because the client lacked the necessary password hash. He said the low counts were harmless because salting alone makes PBKDF2 resistant to GPU attacks.

Question 5: What alternative to PBKDF2 did Steve recommend password managers consider because it is memory-hard and not GPU-friendly?

Question 5

What alternative to PBKDF2 did Steve recommend password managers consider because it is memory-hard and not GPU-friendly?

SHA-1 with a higher iteration count and a larger salt. Scrypt, or another memory-hard scheme such as Argon2. RSA key stretching with a 2048-bit modulus and a client-side pepper. ECB, because it hides repeated passwords by changing the ciphertext block size.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.