Cracking encrypted LastPass vaults
Good tutorial. This is why I prefer 1Password, as it requires the secret key to be compromised in addition to the Master Password, thus providing protection against a weak master password.I've always thought it foolish to recommend solutions like LastPass and BitWarden, which don't require a secret key. It is dangerous design, prioritizing ease of onboarding over actual security.The average consumer needs an autogenerated secret key. It provides entropy where the user will refuse to. Everyone I have helped set up a LastPass or Bitwarden account have chosen simple passwords, and are extremely resistant to the point of anger if you make them choose a complex one. After a few weeks, my mother changed her complex password back to a simple one behind my back - the only time she's learnt computer functionality on her own.1Password's whitepaper, IMO, also shows that it's ahead of the game in general.I wasn't surprised when LastPass was hacked - indeed, I've been expecting it for years - poor software quality and bad security choices were the red flags. Hopefully this forces BitWarden and LastPass to change and introduce generated secret keys in their account creation phase.