Hacker News Reader

Comment by stefan_ | Hacker News Reader

Why on earth is that even configurable, what a bizarre decision. It's like my bank asking me how many bits I'd like in my hashes, only more useless.

This kind of meaningless voodoo is a big red flag for any "security company".

View on HN

If it’s a tradeoff between login speed and security, it seems reasonable to allow users to chose where they want to land between the two, at least within reasonable parameters.

That’s an engineering decision but it shouldn’t be directly exposed in the UI because people don’t understand the trade offs or update it as hardware improves. It’d be better as a time-based setting which changes periodically as attack capacity increases, and perhaps a UI toggle like “faster on ancient hardware, less secure” and “more secure”. You could even automatically improve that over time (“you haven’t used a slow device in 6 months. Want to update to our recommended secure level?”).

Decryption is done on user device so default iteration is set not to be too slow on slower devices. If your all devices are fast enough, It's good to configure it.

Wait, the default is the less secure option?

This company is a joke.

It's fine that you want extremely secure iteration counts like 99999999999999999999, but you should wait 9999 seconds to unlock. Every product should have just right default value. LastPass default iteration value was maybe fine in 2008 but computer power is improving.

Exactly, and it's buried deep in a menu that I didn't know existed

Reply on news.ycombinator.com