91–100 of 247 posts
It seems they take info from the site (its name?) plus your master password and hash them - "LessPass uses PBKDF2 with 8192 iterations and a hash function sha-256."
I guess they then produce something of the required length and characters from the hash.
Guess it's ok till someone finds your master password.
Your master password is 'passwordpassword'. 10 points if you know how I figured that out :)
Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…
As a work flow nit-pick, what if the password requirements change? You need to remember the original settings to generate your password, but if the site now says "must include numbers" when it didn't before...
I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features . No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and sc…
Obviously you are not the target audience for the main website; it explains how it works in general terms , i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective . I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how…
"how it works" should show you the internals
"what it does" is better description if you are just going to tell me the inputs and outputs.
A gentle critique: don't use "How it works?" since that is not proper English. "How does it work?" is better.
As an ESL speaker myself, I wouldn't nitpick about grammar, though. The language on the site is very good in general, and learning second languages is very difficult. Je sais je ne peux ecriver francais bien. Right?
Earlier quoted context omitted.
I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…
>I really like the browser integration, which there isn't anything comparable for pass. people keep saying stuff like this (the one i use because x feature has no real competitor) lastpass. i've used most password managers out there and lastpass hits all these points and more
If the worst comes to worst, I'll probably move to Dashlane (which is significantly more expensive & a bit more work to use - extensions won't work without a desktop app)
A gentle critique: don't use "How it works?" since that is not proper English. "How does it work?" is better.
"How it works" without the question mark is fine, too. The site actually uses "How it works ?" which is a dead giveaway that the author is French. As an ESL speaker myself, I wouldn't nitpick about grammar, though. The language on the site is very good in general, and learning second languages is very difficult. Je sais je ne peux ecriver francais bien. Right?
Earlier quoted context omitted.
I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?
You can use a hash of the site appended with a .pass wide pepper as the name of the directory storing credentials for a particular site, then use a wrapper script that hashes its input before passing it to pass. Also full disk encryption.
Full disk encryption also doesn't prevent a running application from seeing the directory structure. But I guess this is not a very realistic attack vector.
How is this different from having one password for all sites? If I break the master password I gain access to everything.
* if password hashes from any site you use leak and they’re weak, you’re compromised everywhere
* if any site is or becomes malicious and its operators/hackers read your password, you’re compromised everywhere
This approach (maybe not implementation – its hashing is kind of weak) is fine if your master password is strong enough, which it should be.
When I find stuff like this that uses SHA256, I instantly just tune out. SHA256 is stupid. Use SHA512 or find another line of work. SHA512 is astronomically more secure. Anyone who is using anything less than SHA512 for hashing is an idiot.