LessPass: sync-less open source password manager
lesspass.com
LessPass: sync-less open source password manager
1–10 of 247 posts
Re: LessPass: sync-less open source password manager
#2I don't know what these are used for, but secret keys generated from current time are easy to guess. You only have to try around 2^24 values if you can estimate installation time within a specific year.
https://github.com/lesspass/lesspass/blob/master/lesspass.sh...
Re: LessPass: sync-less open source password manager
#3Not-so-good good idea?
Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first.
Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.
Re: LessPass: sync-less open source password manager
#4What happens when the method of creating passwords needs updating, do I then need to visit countless numbers of sites to change the password?
I like the idea don't get me wrong, I just can't see all of the downsides right now which will stop me using it.
Elephant in the room: Are you going to be sued by lastpass for the name?
Re: LessPass: sync-less open source password manager
#5I wouldn't use a password manager system that doesn't have the ability to change the master password.
EDIT: You can't change any password really, without changing all of them (or having a separate master password). Seems unpractical as soon as, for example, site X gets its database hacked.
Re: LessPass: sync-less open source password manager
#6I don't know what these are used for, but secret keys generated from current time are easy to guess. You only have to try around 2^24 values if you can estimate installation time within a specific year. https://github.com/lesspass/lesspass/blob/master/lesspass.sh...
The SECRET_KEY is used by Django, see here:
https://stackoverflow.com/questions/7382149/django-secret-ke...
EDIT: I've created a issue on GitHub about this. (https://github.com/lesspass/lesspass/issues/43)
Re: LessPass: sync-less open source password manager
#7I don't know what these are used for, but secret keys generated from current time are easy to guess. You only have to try around 2^24 values if you can estimate installation time within a specific year. https://github.com/lesspass/lesspass/blob/master/lesspass.sh...
The SECRET_KEY is used by Django, see here: https://stackoverflow.com/questions/7382149/django-secret-ke... EDIT: I've created a issue on GitHub about this. ( https://github.com/lesspass/lesspass/issues/43 )
[deleted]
Re: LessPass: sync-less open source password manager
#8Others have expressed most of them, but issues I see with this is:
* Algorithm can't be changed/improved without changing all your passwords.
* Your master password can't be changed without changing all your passwords.
* You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were).
With that said, I really like the outside-of-the-box thinking on this.
Re: LessPass: sync-less open source password manager
#9I wouldn't use a password manager system that doesn't have the ability to change the master password. EDIT: You can't change any password really, without changing all of them (or having a separate master password). Seems unpractical as soon as, for example, site X gets its database hacked.
Actually, you can. See https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4...
Re: LessPass: sync-less open source password manager
#10Here a write up on how it works: https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4...