Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

11–20 of 247 posts

Re: LessPass: sync-less open source password manager

#12

Post by [deleted] »

HackinOut wrote: post #5

I wouldn't use a password manager system that doesn't have the ability to change the master password. EDIT: You can't change any password really, without changing all of them (or having a separate master password). Seems unpractical as soon as, for example, site X gets its database hacked.

[deleted]

Re: LessPass: sync-less open source password manager

#13

Post by b15h0p »

jiehong wrote: post #3

Not-so-good good idea? Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first. Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.

You could just put the Algorithm or the version into the configuration. That would at least allow a gradual migration.

Re: LessPass: sync-less open source password manager

#14

Post by HackinOut »

mgliwka wrote: post #9
HackinOut wrote: post #5

I wouldn't use a password manager system that doesn't have the ability to change the master password. EDIT: You can't change any password really, without changing all of them (or having a separate master password). Seems unpractical as soon as, for example, site X gets its database hacked.

Actually, you can. See https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4...

That is either by using the "connected version" or loosing the multi devices ability. BTW shouldn't the "connected version" be the one detailed on the home page? Sure sounds more attractive to me.

Re: LessPass: sync-less open source password manager

#16

Post by czechdeveloper »

jiehong wrote: post #3

Not-so-good good idea? Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first. Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.

You are right. I made me similar tool. It just made MD5 out of mater password and service name.

You suddenly realize how many services have special rules you can't fit in. So for each service, I had to remember master password, which "url" i used (gmail.com or mail.google.com?) and which restrictions apply. Usually they did not allow me so long password. Sometimes I was limited to 16, sometimes 12 chars.

After big password leak (heartbleed), I had to setup second master password for all affected service.

So, no. No more sync-less state-less password managers for me.

Re: LessPass: sync-less open source password manager

#17

Post by 3pt14159 »

Very cool project!

One thing though, LessPass sets HSTS headers, but should include the `includeSubDomains` directive and the `preload` directive to stop a first time MITM (for example, when you get a new phone). Once these are done, LessPass should be added to various browser preload lists.

Re: LessPass: sync-less open source password manager

#18

Post by arcticfox »

czechdeveloper wrote: post #16
jiehong wrote: post #3

Not-so-good good idea? Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first. Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.

You are right. I made me similar tool. It just made MD5 out of mater password and service name. You suddenly realize how many services have special rules you can't fit in. So for each service, I had to remember master password, which "url" i used (gmail.com or mail.google.com?) and which restrictions apply. Usually they did not allow me so long password. Sometimes I was limited to 16, sometimes 12 chars. After big pa…

Isn't that what the hosted profile is for?
Post reply on HN