Can I change the master password?
LessPass: sync-less open source password manager
61–70 of 247 posts
Re: LessPass: sync-less open source password manager
#62It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html
I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?
Fellow pass user here.
freepass [0] seems like it could be a potential candidate, somewhere between pass and LessPass, but I haven't tried it out for myself yet.
Re: LessPass: sync-less open source password manager
#63How is this better/worse than https://addons.mozilla.org/en-US/firefox/addon/easy-password... which claims that "No web servers involved, the data never leaves your computer."?
Re: LessPass: sync-less open source password manager
#64It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html
I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?
You could encrypt the password store folder with another gpg container. That would be your master password.
Re: LessPass: sync-less open source password manager
#65It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html
I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?
Maybe you can put the whole .pass directory inside an encfs directory.
Encryption all the way down.
Re: LessPass: sync-less open source password manager
#66Lastpass is free now for mobile devices. Enjoy!
Re: LessPass: sync-less open source password manager
#67I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features.
No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and scrolling past a bullet list and stylised quotation, we get
"The trick is to compute passwords rather than generate and store random passwords.
LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know."
"Next-gen", "Anywhere, anytime", "Manage directly from your browser". These are all super cliched, really cheap phrases that I really dislike. The front page is full of them. If you're marketing a luxury yacht trip to people with more money than sense, then sure you're probably going to get good results by writing like this. But the folk reading about this are going to be pretty technical and I'm sure everyone would appreciate to see something like "We provide a function that generates a memorable password from the site name and your master password" on the front page, above the fold.
In terms of entropy, you may as well come up with your own function. Security through obscurity is bad (no one knows the function you use to generate site specific passwords) but it's better than security through less obscurity (use a public function that a bunch of other people are using).
You can't get free entropy. If you care about your passwords not being broken when a database of hashes is dumped, you need to use a long, securely generated, random password. Sure, this is better than using the same password everywhere, but it's not really an alternative to something that uses proven cryptography to generate secure unique passwords. Passwords generated using this are only as good as your master password, with some obscurity thrown in.
Re: LessPass: sync-less open source password manager
#68This one isn't bad either https://keeweb.info/
This looks really nice as well, is there a catch? Why would I pay for eg LastPass?
Lastpass is free now for mobile devices! If that is what you were willing to pay for!
It syncs seamlessly across all desktop browsers, iOS and Android devices without any issues.
Re: LessPass: sync-less open source password manager
#69When I find stuff like this that uses SHA256, I instantly just tune out. SHA256 is stupid. Use SHA512 or find another line of work. SHA512 is astronomically more secure. Anyone who is using anything less than SHA512 for hashing is an idiot.
We had this conversation when it was md5 vs sha2 and concluded sha2 was good enough. What changed?
Re: LessPass: sync-less open source password manager
#70How do you deal with sites whose password requirements don't match the output of LessPass? How do you handle the fact that sites want you to change your password? Yes. There's a counter field, but how do you know what site uses what version of the counter? How do you change the master password without having to change all passwords? Thing is: There's a solution for all these problems: All you have to do is actually g…
I think there is where the connected version can play an important role. From my understanding it stores everything but the password, so that can keep track of password rules, counters, etc per site. I think the biggest issue still is what happens when you change your master password? Because I couldn't find an answer for that. >aside of storing the state somewhere, but if you're doing that, why not just store the pa…
State for password managers is almost always stored encrypted, i.e. in a form useless to the attacker.