Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

41–50 of 247 posts

Re: LessPass: sync-less open source password manager

#41

Post by majewsky »

msl09 wrote: post #39

I started using Nic Wolff's password generator[0] to solve that very problem, but I noticed that the need for connected passwords makes up a large size of the passwords that I needed to use, so I gave up on the idea of "store nothing passwords". The idea of generating always the same password for the same site is also doesn't work, because of database breaches, so in the end I created a program[1] that did all the th…

Looks pretty similar to what I'm using: https://github.com/majewsky/pwget

Mine doesn't have any provisions for passwords with a specific length or charset. If someone does not like what my pwget generates, I will adjust the password manually and write down the rules in a file that is kept in a private Git repo.

Re: LessPass: sync-less open source password manager

#45

Post by majewsky »

erikb wrote: post #23
jiehong wrote: post #3

Not-so-good good idea? Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first. Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.

There are a lot of reasonable complaints in the comments, but "you need to change your passwords when changing to this service" is actually not one. You want to do that anyway from time to time, and when you are using a new password manager is actually a great time.

It's also really shocking to see just how many accounts the average person amasses. My KWallet had some 250 entries at peak times.

Re: LessPass: sync-less open source password manager

#46

Post by joosters »

erikb wrote: post #23
jiehong wrote: post #3

Not-so-good good idea? Given that you already have dozens of site with their own passwords, you just can't import your passwords, but you need to change all of them to start using lesspass first. Also, if the way the generation of passwords works changes later (i.e. bug), then the users are stuck with a version, or the bug is never fixed, ever.

There are a lot of reasonable complaints in the comments, but "you need to change your passwords when changing to this service" is actually not one. You want to do that anyway from time to time, and when you are using a new password manager is actually a great time.

If you want to change your passwords from time to time, as you say, then this system isn't going to suit you, because it only ever generates one password for each site.

Re: LessPass: sync-less open source password manager

#49

Post by joosters »

croon wrote: post #8

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…

Also, some sites (generally banks) change their login URLs and domains from time to time. With a 'traditional' password manager, I can map it to the old login details with a few clicks. With a stateless system, you're out of luck.

Re: LessPass: sync-less open source password manager

#50

Post by andresgottlieb »

zimpenfish wrote: post #48
wyclif wrote: post #44

A gentle critique: don't use "How it works?" since that is not proper English. "How does it work?" is better.

On what grounds is it not "proper English"?

http://ell.stackexchange.com/questions/17778/how-it-works-vs...
Post reply on HN