This week on Home Gadget Geeks Jim and Christian catch up on the Last Pass Data Breach. We talk about why the security industry had a field day and introduce foundational concepts to password managers along the way. We also walk through some other password managers with similar bumps in the road over the years and what are some of the characteristics that stand out for password managers that can earn consumer trust. We then explore Christian’s migration to Bitwarden and what makes it a stand-out option amongst some of the preferred options for password management. It’s 2023 and we are still talking about password managers…. If that’s not insanity what is?! Thanks for listening!

 

Full show notes, transcriptions (available on request), audio and video at http://theAverageGuy.tv/hgg559

Join Jim Collison / @jcollison for show #559 of Home Gadget Geeks brought to you by the Average Guy Network.

WANT TO SUBSCRIBE? http://theAverageGuy.tv/subscribe

Join us for the show live each Thursday at 8pmC/9E/1UTC at http://theAverageGuy.tv/live

Popular Tags: Podcast, Home Gadget Geeks, Home automation, Smart home technology, Internet of Things (IoT), Home appliances, Home entertainment systems, Home security, Home energy management, Home renovation and DIY, Home gadget reviews, Home technology trends

 

Find Us!

Join us in the Facebook group at https://www.facebook.com/groups/theaverageguy/

On Discord at https://theaverageguy.tv/discord

Save $40 on your first Box of HelloFresh

Last Pass Breach

https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/

* “Lots of buzzwords here. 256-bit AES encryption, unique encryption key, Zero Knowledge architecture, all that sounds very reassuring. It masks over a simple fact: the only thing preventing the threat actors from decrypting your data is your master password. If they are able to guess it, the game is over.”

Zero Knowledge Encryption Principles:

* Password is NEVER stored.

* All data is encrypted locally on the client, never on the server.

* Servers only ever store encrypted bits.

* Encryption key on the client is always generated and derived from the master password.

Some of the main issues discussed in the Last Pass breach (or as some would say, lack of containment):

* Default for 12 character minimum password wasn’t enforced until 2018. Previous customers weren’t asked to move over to that standard.

* PBKDF2 is a critical feature of reducing brute force attack likelihoods. Minimum expected is 100K iterations in most modern password managers.

* Many Last Pass accounts were still configured with only 5000 iterations. Some accounts later on found were as low as 500. OWASP recommends 310K

What’s PBKDF2 (Password-Based Key Derivation Function)?

* Put simply, it’s a modern cryptographic hashing function that computes iterative HMACs to make passwords resistant to dictionary attacks and rainbow attacks: