Not in a million years: It can take far less to crack a LastPass password | 1Password

Abstraction: LastPass breach exposes why human passwords are crackable despite PBKDF2

Key points:

• LastPass August 2022 breach exposed password hashes; company claimed "millions of years" to crack using 100,100 PBKDF2 rounds and 12-character minimum passwords
• Claim is misleading: it assumes random passwords; human-created passwords have far lower entropy and attackers search likely patterns first
• Cracking 100,000-round PBKDF2-SHA256 costs ~$6 per 2^32 guesses; 10 billion guesses cost under $100 — affordable for human-created passwords
• Humans cannot create high-entropy passwords even with complexity rules (mixed letters, numbers, symbols); machine-generated passwords are required for true security
• 1Password's Secret Key: 128-bit random value created on-device, never transmitted to 1Password servers; attacker with a server-side breach cannot decrypt data without it
• Defense must plan for breach: Secret Key protects against server breach; users still need machine-generated account passwords for device-level protection

Connections: Lastpass · 1password · Password Security · Key Derivation · Cryptography

Source: https://blog.1password.com/not-in-a-million-years/