Light

Episode #906 Quiz

The Rule of Two
Date: 2023-01-17 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

LastPass’s client-side PBKDF2-derived vault key remains protected only by local iteration counts; server-side 100,000-round PBKDF2 plus Scrypt secures the login hash, not the vault. Norton LifeLock likely lacked brute-force defenses against credential stuffing. Google’s Rule of Two limits untrusted inputs, unsafe languages, and high-privilege code, driving Rust adoption.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what did LastPass's server-side PBKDF2 and scrypt processing actually protect?

Question 1

According to the episode, what did LastPass's server-side PBKDF2 and scrypt processing actually protect?

The stored login hash used to verify future logins The locally derived vault decryption key used on the client The encrypted vault blob already stored online on LastPass servers The email address and account salt used to derive the master password key

Question 2: Why did Steve conclude that changing the LastPass iteration count did not mitigate the weakness he had worried about?

Question 2

Why did Steve conclude that changing the LastPass iteration count did not mitigate the weakness he had worried about?

Because the login hash was never used for any authentication decision Because the local client ignored the iteration count and always used one round Because the extra server-side hashing did not reencrypt the vault data Because changing the iteration count automatically deleted the vault's older records

Question 3: What was the practical effect of changing a vault's iteration count on older ECB-mode items, based on the listener feedback Steve discussed?

Question 3

What was the practical effect of changing a vault's iteration count on older ECB-mode items, based on the listener feedback Steve discussed?

It forced those items to be reencrypted in ECB mode It caused those items to be reencrypted in CBC mode It removed those items from the vault and required manual restoration It converted those items into plaintext notes for migration

Question 4: What was the specific vulnerable driver used in the CrowdStrike-documented BYOVD attempt against the Scattered Spider / Roasted 0ktapus / UNC3944 adversary?

Question 4

What was the specific vulnerable driver used in the CrowdStrike-documented BYOVD attempt against the Scattered Spider / Roasted 0ktapus / UNC3944 adversary?

Intel Ethernet diagnostics driver iqvw64.sys An AMD storage driver distributed through Windows Update A Microsoft printer driver signed in 2018 A Qualcomm Wi-Fi driver blocked by default in Windows Vista

Question 5: In Google's Rule of Two, which combination is explicitly the one to avoid?

Question 5

In Google's Rule of Two, which combination is explicitly the one to avoid?

Complex parsing, network transport, and code review Sandboxing, normalization, and interprocess communication Untrustworthy inputs, unsafe implementation language, and high privilege High throughput, low latency, and small code size

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.