Palant picks apart LastPass's breach statement and iteration counts

Following up with the LastPass debacle around end of December. It started with a second breach in November that built on information from the August incident. In December, LastPass admitted that a backup of the encrypted customer vaults was copied too. Wladimir Palant provides a good analysis of the official press release. Overall, they seem to not have followed best-practice recommendations. In a second post, Palant shows that many older accounts were never migrated to the advertised 100,100 PBKDF2 iterations, with users reporting 5,000, 500 or even a single iteration, which is less key derivation than formality. Parent company GoTo has since confirmed that the attacker also took encrypted backups of its Central, Pro, join.me, Hamachi and RemotelyAnywhere products from the cloud storage it shares with LastPass, along with an encryption key for part of them. As such, switching to another provider and cycling all passwords might be recommended.