LastPass breach: The significance of these password iterations (opens in new tab)

Disclaimer: I’m the author of this article.

No, the iteration count is no secret. It’s even exposed via a public API, anyone can query it if they know the email address.

[1] makes it seem like the number of rounds is included unencrypted at least on the client side binary databases. As it's sent over the wire when downloading the vault, lastpass would _have_ to have that in clear text somewhere.

[1] https://github.com/cfbao/lastpass-vault-parser

Disclaimer: I’m the author of this article.

Yes. The number of iterations is presumably stored in the same customers database that they stole. Even if not: the number of iterations can be queried via a public API, anyone can do it if they know the email address.

Disclaimer: I’m the author of this article.

I don’t think so. 346,000 guesses four years ago was for the old default: 5,000 iterations. 88,000 guesses is on more powerful hardware but with the new default: 100,100 iterations.

Disclaimer: I’m the author of this article.

I’m not missing anything. It’s LastPass who finally need to retract this article. I proved back in 2018 that server-side iterations are misimplemented and have no security effect. That’s why they increased the client-side value in the first place. See https://palant.info/2018/07/09/is-your-lastpass-data-really-...