111–120 of 247 posts
* encrypt password profiles client side.
* help user change their master passwords (https://github.com/lesspass/lesspass/issues/36)
* mobile version(https://github.com/lesspass/lesspass/issues/6)
Change his master password seems to be the biggest problem for many of you. We will address this problem as a priority.
Works by using a master password and a keyword to generate a seed, then applies various deterministic algorithms to generate multiple passwords.
Earlier quoted context omitted.
Obviously you are not the target audience for the main website; it explains how it works in general terms , i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective . I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how…
Well there are different levels of description here. First, I think I am pretty representative of the target audience for the main website (it's sad, but most non technical people still don't know what a password manager is or why they might want to use one). Second, there is a difference between "What it does" (A password manager that re-computes the same site-specific password on every use, meaning that no syncing…
Maybe they're trying to make a website for non technical people, in order to gain some traction among that audience?
If developers keep pandering to the technical audience who already knows enough about the purpose of password lockers, you have a circular problem where the general audience never learns about them.
And remember, marketing phrases exist because they work. If you don't know what a product is good for, the seller needs to state it in plain terms in order to convince the customers of how it could benefit them.
What happens if a site requires you to change passwords regularly and keeps a history of the passwords you've used? Wouldn't you be locked on a single password for each site (or a very limited number of options to force the app to change it)
I guess you can increment the password length by one each time. Though you have to keep track of the last used length.
Doesn't look like a win situation for me.
Earlier quoted context omitted.
respectfully disagree. "how it works" should show you the internals "what it does" is better description if you are just going to tell me the inputs and outputs.
But the page does show you the internals of what it does, it's just that it's done in a very high level, enough for the non-technical people who will most benefit from that page: "The trick is to compute passwords rather than generate and store random passwords. LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know." "It does not save yo…
What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
it looks like anyone can try to brute force your password based on the login/site combo. can someone tell me why i'm wrong here?
It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html
I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…
I understand that 1password on iOS doesn't interact as a third party keyboard, and 1password is an iOS/mac app first and foremost, but that's no excuse for making their Android UX so incredibly frustrating.