Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

21–30 of 247 posts

Re: LessPass: sync-less open source password manager

#21

Post by lemoniidae »

croon wrote: post #8

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…

I have written a similar Password manager as an UWP for Windows [0]. It didn't get much attention since i never tried to get some.

I could not agree more with the points you mentioned. To solve the last one I added the option to create an encrypted list for the sites. But so you end with an additional password you need to remember because using the same as for the masterkey makes this the only key to access every password. And this is what the system tries to avoid.

[0] https://github.com/AndHell/CreatePass

Re: LessPass: sync-less open source password manager

#23

Post by erikb »

jiehong wrote: post #3

Not-so-good good idea? Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first. Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.

There are a lot of reasonable complaints in the comments, but "you need to change your passwords when changing to this service" is actually not one. You want to do that anyway from time to time, and when you are using a new password manager is actually a great time.

Re: LessPass: sync-less open source password manager

#26

Post by askmike »

mrleinad wrote: post #24

What happens if a site requires you to change passwords regularly and keeps a history of the passwords you've used? Wouldn't you be locked on a single password for each site (or a very limited number of options to force the app to change it)

I guess you can increment the password length by one each time. Though you have to keep track of the last used length.

Re: LessPass: sync-less open source password manager

#27

Post by bryanlarsen »

mrleinad wrote: post #24

What happens if a site requires you to change passwords regularly and keeps a history of the passwords you've used? Wouldn't you be locked on a single password for each site (or a very limited number of options to force the app to change it)

From the FAQ:

How do I change a password without changing my master password?

That’s the purpose of the counter field in the options field set, increment it and you will get a new password.

Re: LessPass: sync-less open source password manager

#28

Post by bryanlarsen »

HackinOut wrote: post #14
mgliwka wrote: post #9

Earlier quoted context omitted.

Actually, you can. See https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4...

That is either by using the "connected version" or loosing the multi devices ability. BTW shouldn't the "connected version" be the one detailed on the home page? Sure sounds more attractive to me.

Or you have to remember the counter. Since most people just append a counter to their password for those sites that force them to change regularly, it's not really that different. :)

Re: LessPass: sync-less open source password manager

#29

Post by fnj »

When I find stuff like this that uses SHA256, I instantly just tune out. SHA256 is stupid. Use SHA512 or find another line of work. SHA512 is astronomically more secure. Anyone who is using anything less than SHA512 for hashing is an idiot.

Re: LessPass: sync-less open source password manager

#30

Post by fnj »

askmike wrote: post #26
mrleinad wrote: post #24

What happens if a site requires you to change passwords regularly and keeps a history of the passwords you've used? Wouldn't you be locked on a single password for each site (or a very limited number of options to force the app to change it)

I guess you can increment the password length by one each time. Though you have to keep track of the last used length.

For brain dead sites with rules like "min 6 chars, max 8, mandatory change every 60 days", that won't take you very far.
Post reply on HN