Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

131–140 of 247 posts

Re: LessPass: sync-less open source password manager

#131

Post by Ajedi32 »

adilparvez wrote: post #40

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html

Eh, the UX doesn't look great compared to my current solution (KeePass). No browser integration or auto-type, no InputStick support on mobile, etc.

YubiKey support looks pretty nice though; I'm not sure there's an easy way to do what with KeePass.

Re: LessPass: sync-less open source password manager

#132

Post by austinjp »

gtrubetskoy wrote: post #89
sixhobbits wrote: post #84

Earlier quoted context omitted.

Considering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)

Lol - that's what happens when posting on a Monday before finishing the morning coffee. Someone commented on my article then that you can pretty much accomplish this from the command line with: > echo "masterpassword gmail" | md5 (Ignoring the implication of the password potentially getting logged in shell history, of course.)

Maybe try just

> md5sum | cut -d" " -f1

or similar. Carriage-return followed by ctrl-D to exit. Output matches echo "whatever" | md5sum | cut -d" " -f1 in my term.

Re: LessPass: sync-less open source password manager

#133

Post by obi1kenobi »

JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

I completely agree. What makes all of it even worse is that they only use 8192 iterations of PBKDF2, based on their blog post [1]. To counter GPU-based password cracking, 100,000+ iterations are needed as of 5 years ago [2].

[1] https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4

[2] http://stackoverflow.com/questions/6054082/recommended-of-it...

Re: LessPass: sync-less open source password manager

#134

Post by sk5t »

stavros wrote: post #128
grhino wrote: post #117

Earlier quoted context omitted.

These weaknesses all hold if it's discovered that lesspass is in use. How would information that the user is using lesspass leak?

The GP's points are all a bit weak, especially if this method uses a good KDF like bcrypt to generate the keys. I used SuperGenPass for a while, before switching to KeePass, and the major drawbacks I found were: 1) No way to change a password. None at all. If a site required you to make up a new password, you're out of luck (or you have to come up with a new master password every time and remember which master passwo…

Bcrypt is not really a KDF, it's a strong hash generator + verification processor rolled into one for easy consumption.

See PBKDF2 / RFC2898 for tooling appropriate to generate an expensive-to-generate cryptographic key from a user-supplied passphrase.

Re: LessPass: sync-less open source password manager

#135

Post by Ajedi32 »

z3t4 wrote: post #101
croon wrote: post #8

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…

It's important to change your passwords at regular intervals, even if you use a secure one. If you compare this to two factor authentication it's the same amount of extra work, but without the benefits. You should also avoid copying passwords to the clipboard as many applications and even web sites might have access to it. Too bad client certifications are deprecated, now when SSL/TSL is becoming more and more popula…

There's also some privacy and UX concerns with client certs. See http://www.browserauth.net/tls-client-authentication

Personally I'd love to see UAF or SQRL take off. Lots of potential there.

Re: LessPass: sync-less open source password manager

#136

Post by jimktrains2 »

JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

5) You can't change the password (I guess they could include a counter, but then you need to remember or sync that.)

Re: LessPass: sync-less open source password manager

#137

Post by omtose »

adilparvez wrote: post #108
omtose wrote: post #98

Earlier quoted context omitted.

This is all a lot of effort, if I went down that road I might as well skip "pass" and handle the passwords myself. What I like about pass is that there isn't much setup. Full disk encryption also doesn't prevent a running application from seeing the directory structure. But I guess this is not a very realistic attack vector.

Yes, under that threat model you would lose with all of these password managers.

How so? If the entire directory structure is also encrypted then no program can easily know which sites or services I have passwords for.

Re: LessPass: sync-less open source password manager

#138

Post by teach »

atemerev wrote: post #77

OK, fine. This is one thing I can finally use. (I can't use regular storage-based password managers, as I have ADD and I will lose my password file. If it is backed up, I will lose a backup, or I will forget to update it when passwords are changed, or something else. I always screw such things up, this is absolutely inevitable, so I have to prepare. To compensate, my symbolic memory is excellent, so I just chose to m…

What's wrong with something like Lastpass?

Re: LessPass: sync-less open source password manager

#139

Post by [deleted] »

jimktrains2 wrote: post #136
JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

5) You can't change the password (I guess they could include a counter, but then you need to remember or sync that.)

[deleted]

Re: LessPass: sync-less open source password manager

#140

Post by s9ix »

Wouldn't enabling two-factor on the primary login and naming sites whatever you want solve most gripes with this (in the comments here)?

i.e. I name hacker news hn or hack, as opposed to news.ycombinator.com - one more thing to guess for an attacker.

Post reply on HN