LessPass: sync-less open source password manager • Hacker News Board

Re: LessPass: sync-less open source password manager

#101

Post by z3t4 » Mon, Nov 07, 2016, 1:55 PM UTC

croon wrote: post #8

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…

It's important to change your passwords at regular intervals, even if you use a secure one.

If you compare this to two factor authentication it's the same amount of extra work, but without the benefits.

You should also avoid copying passwords to the clipboard as many applications and even web sites might have access to it.

Too bad client certifications are deprecated, now when SSL/TSL is becoming more and more popular. Only downside with client certificates is that you have to copy the key (witch can be password protected) to all your devices. Another downside was that the site required SSL/TSL, but almost every site have that now!

Re: LessPass: sync-less open source password manager

#102

Post by JulianMorrison » Mon, Nov 07, 2016, 1:58 PM UTC

What this seems to be, in essence: password = HMAC(key, website).

Why this is bad, compared to an encrypted on-disk key store:

1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker.

2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure serial guessing will break it fast.

3. They don't need any access to you or your stuff, to guess a key. They don't even need access to the server, it can be guessed on an unrelated machine. You don't have the opportunity to detect a break-in and neither does your bank, etc.

4. You only have one password for all the sites, really, underneath, and it's your secret key. If it's broken, it's now a skeleton-key and your digital ass is theirs.

Re: LessPass: sync-less open source password manager

#103

Post by lucaspiller » Mon, Nov 07, 2016, 1:59 PM UTC

gr3yh47 wrote: post #76

lucaspiller wrote: post #58

Earlier quoted context omitted.

I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…

>I really like the browser integration, which there isn't anything comparable for pass. people keep saying stuff like this (the one i use because x feature has no real competitor) lastpass. i've used most password managers out there and lastpass hits all these points and more

I think you misunderstood my comment. I meant that there isn't anything comparable to 1Password's browser integration for pass (https://www.passwordstore.org/).

Re: LessPass: sync-less open source password manager

#104

Post by ejcx » Mon, Nov 07, 2016, 2:01 PM UTC

adilparvez wrote: post #40

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html

Not to shamelessly self promote, but if you like pass but hate GPG, then I already built you a command line password manager that is almost exactly the same as pass

It can securely save files, generate passwords, save passwords and optionally can sync using git.

https://github.com/ejcx/passgo

Re: LessPass: sync-less open source password manager

#105

Post by porker » Mon, Nov 07, 2016, 2:02 PM UTC

ohstopitu wrote: post #96

gr3yh47 wrote: post #76

Earlier quoted context omitted.

>I really like the browser integration, which there isn't anything comparable for pass. people keep saying stuff like this (the one i use because x feature has no real competitor) lastpass. i've used most password managers out there and lastpass hits all these points and more

After lastpass was bought out, I went on a spree to find a different password manager and in that process, I tried almost all of them (free & paid). Nothing came close to Lastpass so I decided to stick with them until they mess up. If the worst comes to worst, I'll probably move to Dashlane (which is significantly more expensive & a bit more work to use - extensions won't work without a desktop app)

Why were Lastpass and Dashlane better than 1Password for you?

I've used 1P for a few years without looking at the competition, so curious to hear what they can do.

Re: LessPass: sync-less open source password manager

#106

Post by sixhobbits » Mon, Nov 07, 2016, 2:07 PM UTC

TuringTest wrote: post #86

sixhobbits wrote: post #67

I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features . No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and sc…

Obviously you are not the target audience for the main website; it explains how it works in general terms , i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective . I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how…

Well there are different levels of description here.

First, I think I am pretty representative of the target audience for the main website (it's sad, but most non technical people still don't know what a password manager is or why they might want to use one).

Second, there is a difference between "What it does" (A password manager that re-computes the same site-specific password on every use, meaning that no syncing of passwords is necessary) which you can still make pretty informative vs "Me telling you why you should use it" (The cliches I quoted). Even if the website was aimed at those with zero technical knowledge, it could still give more concrete detail on what it is and why you need it rather than the empty marketing phrases.

The github repo should be where I go if I want to know what hashing libraries they're using, if their Math checks out, and who the contributors are. Not if I just want to know what it actually is (apart from "The best ever super duper password manager that you really need to download right now before tomorrow") and kind-of-how it works.

Re: LessPass: sync-less open source password manager

#107

Post by 3pt14159 » Mon, Nov 07, 2016, 2:10 PM UTC

pilif wrote: post #38

How do you deal with sites whose password requirements don't match the output of LessPass? How do you handle the fact that sites want you to change your password? Yes. There's a counter field, but how do you know what site uses what version of the counter? How do you change the master password without having to change all passwords? Thing is: There's a solution for all these problems: All you have to do is actually g…

The problem with writing passwords down is that I need to fly places and it's not unheard of if you work in financial tech or military tech to have your things riffled through at the boarder. Plus a mugger can say "give me your things!" or "Empty your pockets!" and now he has my credentials.

Passwords are not easy. My current solution for the long tail of things that need passwords is two factor + really strong password I generate then don't save anywhere. If I get signed out I do password reset to my gmail. Gmail is two factor (obviously) with a really strong password and recovery email to an email address nobody knows.

This is still a huge pain though.

Re: LessPass: sync-less open source password manager

#108

Post by adilparvez » Mon, Nov 07, 2016, 2:16 PM UTC

omtose wrote: post #98

adilparvez wrote: post #85

Earlier quoted context omitted.

You can use a hash of the site appended with a .pass wide pepper as the name of the directory storing credentials for a particular site, then use a wrapper script that hashes its input before passing it to pass. Also full disk encryption.

This is all a lot of effort, if I went down that road I might as well skip "pass" and handle the passwords myself. What I like about pass is that there isn't much setup. Full disk encryption also doesn't prevent a running application from seeing the directory structure. But I guess this is not a very realistic attack vector.

Yes, under that threat model you would lose with all of these password managers.

Re: LessPass: sync-less open source password manager

#109

Post by shawnzvinis » Mon, Nov 07, 2016, 2:16 PM UTC

Thanks for building and posting this! I regularly think about being "locked out" of everything if I were to loose all my devices (e.g. get robbed). I hope this product will evolve to solve some of the concerns people have raised above.

Re: LessPass: sync-less open source password manager

#110

Post by TuringTest » Mon, Nov 07, 2016, 2:19 PM UTC

appleflaxen wrote: post #94

TuringTest wrote: post #86

Earlier quoted context omitted.

Obviously you are not the target audience for the main website; it explains how it works in general terms , i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective . I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how…

respectfully disagree. "how it works" should show you the internals "what it does" is better description if you are just going to tell me the inputs and outputs.

But the page does show you the internals of what it does, it's just that it's done in a very high level, enough for the non-technical people who will most benefit from that page:

"The trick is to compute passwords rather than generate and store random passwords.

LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know."

"It does not save your passwords in a database. It does not need to sync your devices together. "

"The system uses a pure function, i.e. a function that given the same parameters will always give the same result. In our case, given a login, a master password, a site and options it will returns a unique password."

Etc.