@briankrebs This would be the _single round_ hashed somewhat bad Master password users I assume though*? Those should indeed be bruteforceable.

Somewhat surprised users didn't understand that when LastPass did communicate about the single round hashing etc - they could've just moved their crypto to another seed

I know someone in cybersec who has on purpose left some small amounts of bitcoin in a wallet where the seed existed in their LastPass account at the time. Those coins are still there - but the user had a strong Master password.

*) if my memory serves me right

@briankrebs "one bad click"

2) "years ago he used Google Photos to store an image of the secret seed phrase that was protecting his cryptocurrency wallet"

3) "Google Authenticator by default also makes the same codes available in one’s Google account online"

next person:

4) "I put my seed phrase into a phishing site"

This is not a post about people being dumb, on the contrary. It's too easy to put trust into the wrong apps/web sites - and that's where the real issue lies.

The lesson should be: Your data is not safe in the cloud. Stop putting pictures, codes and security backups there.