Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You better add a huge "do not use" warning to that blog post. Deriving passwords via SHA-512 or similar is a very common mistake and makes guessing your master password way too easy. I outlined the details in my blog post here:

https://palant.de/2016/04/20/security-considerations-for-pas...

No, LessPass uses PBKDF2 which is already a lot better than merely SHA-512. However, with 8192 iterations it still makes guessing the master password too easy.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: