Possible Bug allowing to brute force attack

[DemonRx]

https://zerobin.net/?1a5c958003e1461c#PsJTz6BWiopY9aDLtl7trk5zVMBIsCw1MP91zZq4xcY=

Please look into the validity of this claim, I did not do the write-up, it was posted through a slack chat, I'm providing it here for the devs to investigate. thank you

[magicgoose]

Just in case link goes dead, a backup: https://gist.github.com/magicgoose/fd442218cbfc23a7a594192675fc8517

[levitte]

This is discussed quite a bit on reddit as well. There are some responses in that thread that do sum things up pretty well, it makes for a good read.

To sum it up:

• iteration count 1 isn't the best. Add support for PBKDF2 for enc command #2083 addresses that as well as getting a more modern KDF.
• the numbers mentioned at the end of the text you linked to are thread IDs and have nothing to do with any randomness at all.

[levitte]

As far as I can see, the actual issue is addressed. Closing this ticket.