2026-06-03 18:29 UTC
@cibyr@omg.wtf.sh
Right, but to brute force 2FA, don't you first have to break the first authentication factor? That would mean the number of accounts you can brute force is limited to only those you have already compromised.
Replies (1)
-
@sc00bz@infosec.exchange 2026-06-09 05:21
@dangoodin@infosec.exchange @cibyr@omg.wtf.sh Dashlane works with APIs keys. If you have the API key, you can download the vault. The API key is protected by an emailed 6 digit code. An attacker only needs the email to try to register a new device. Once the attacker has the vault they can crack it offline. Last I checked they used Argon2d m=32MiB, t=3, p=2. Which means an attacker should get around 3500 guesses/second on an RTX 5080. At only 32 MiB it will be bandwidth limited: (GPU memory bandwidth) / (32*1024*1024*(3*3-1)) So 960,000,000,000 / 268,435,456 = 3576 H/s