See also pwdhash.com
LessPass: sync-less open source password manager
121–130 of 247 posts
Re: LessPass: sync-less open source password manager
#122What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
These weaknesses all hold if it's discovered that lesspass is in use. How would information that the user is using lesspass leak?
I suspect that if a hacker were focused on a person (say a person under investigation or a celebrity), they could simply use that as one of many strategies in compromising the password.
Re: LessPass: sync-less open source password manager
#123If you re-generate the password for each site, rather than sync, it means (1) you can't change your password on that site, (2) if any site puts in the effort to brute-force guess your password, they will have access to all the sites you visit.
This is not a good idea.
Re: LessPass: sync-less open source password manager
#124What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
These weaknesses all hold if it's discovered that lesspass is in use. How would information that the user is using lesspass leak?
If there's any format regularity in the output, like it's in one of the PKCS message formats, that could be detected. Or if it's a fixed length that could give it away.
Webcam hack. Social engineering. Binoculars. All the things.
Just sweeping them up en masse and trying popular keys.
Re: LessPass: sync-less open source password manager
#125What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
I agree with you and will not be using this tool. but it does seem like a good tool for those that do not want to use a password manager. (better than nothing for sure)
The attacker would have to know that you are using this tool, and they would have to know what you input for the site name and your username/password. So basicly you have three passwords for each site.
Re: LessPass: sync-less open source password manager
#126It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html
I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…
> If I'm on a site with weird requirements I'd have to figure out the params to make pass generate a password which matched it; with the extension I just click a few buttons.
How does this work? I don't suppose there's a micro format for password requirements? Does 1password just have a database of password formats for popular websites?
Re: LessPass: sync-less open source password manager
#127What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
I agree with you and will not be using this tool. but it does seem like a good tool for those that do not want to use a password manager. (better than nothing for sure) The attacker would have to know that you are using this tool, and they would have to know what you input for the site name and your username/password. So basicly you have three passwords for each site.
It would appear to be cryptographically pretty much identically secure as using a single password on all sites, if someone knows who they are targeting and what website. And less secure than having two passwords, your regular one and your Super Sekrit one for Amazon and the bank.
Re: LessPass: sync-less open source password manager
#128What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
These weaknesses all hold if it's discovered that lesspass is in use. How would information that the user is using lesspass leak?
The GP's points are all a bit weak, especially if this method uses a good KDF like bcrypt to generate the keys.
I used SuperGenPass for a while, before switching to KeePass, and the major drawbacks I found were:
1) No way to change a password. None at all. If a site required you to make up a new password, you're out of luck (or you have to come up with a new master password every time and remember which master password to use for which site).
2) If a website is incompatible with the generated password, you're out of luck. My bank (because of course it would be the bank, cat sharing websites are more secure) would throw a fit because I had a number in my password and refuse to set it.
3) If someone has a keylogger or otherwise steals your master password, you're done for everywhere. This is not so with password databases, because the attacker also needs the file.
4) It's just not really that much more convenient than KeePass + KeePassAndroid. Hell, the latter is more convenient because I don't have to keep retyping my password, I can store it in memory protected by my fingerprint, which is something that no SuperGenPass-compatible app I've found does.
In summary: Go with KeePass, it's better.
Re: LessPass: sync-less open source password manager
#129Earlier quoted context omitted.
If it's open source, how can you hope you achieve security through obscurity?
evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they st…
As someone pointed out above, the problem with this argument is that the password becomes cipher text. That means that each time it is gathered by an attacker it gets easier to compromise. For most of us, this is not an issue because there is so much low hanging fruit. For some -- say a celebrity or person of public interest -- this could be a serious problem as they are already the target of a focused effort.
Re: LessPass: sync-less open source password manager
#130Obligatory post about password generators: http://crypto.stackexchange.com/a/5691/291