Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

151–160 of 247 posts

Re: LessPass: sync-less open source password manager

#151

Post by Ajedi32 »

joosters wrote: post #49
croon wrote: post #8

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…

Also, some sites (generally banks) change their login URLs and domains from time to time. With a 'traditional' password manager, I can map it to the old login details with a few clicks. With a stateless system, you're out of luck.

Also, some sites use a unified login which is shared between multiple sites owned by the same company. For example, StackOverflow uses an account which is shared across all the various StackExchange-type sites, and Gamepedia requires you to sign in with your "Curse Community Account". (I'm sure there are more examples; those are just the ones off the top of my head.)

Re: LessPass: sync-less open source password manager

#152

Post by problems »

stavros wrote: post #128
grhino wrote: post #117

Earlier quoted context omitted.

These weaknesses all hold if it's discovered that lesspass is in use. How would information that the user is using lesspass leak?

The GP's points are all a bit weak, especially if this method uses a good KDF like bcrypt to generate the keys. I used SuperGenPass for a while, before switching to KeePass, and the major drawbacks I found were: 1) No way to change a password. None at all. If a site required you to make up a new password, you're out of luck (or you have to come up with a new master password every time and remember which master passwo…

> 3) If someone has a keylogger or otherwise steals your master password, you're done for everywhere. This is not so with password databases, because the attacker also needs the file.

It's about equivalent though. If someone can keylog you, they can probably obtain the file. If that's through malware then they simply grab the file with the malware, if that's through a hardware keylogger then they just grab it off your machine when you're not around. Even if you used FDE, you're dead in the water because they logged your FDE password too.

Heck, if I were the malware author I'd inject into KeePass or similar and dump your decrypted database as soon as you login, immediately bypassing any anti-keylogger tools, keyboards, alternative authentication methods for your password manager, etc that you might have used.

It's important to think about realistic threat models with things like this. If you're keylogged you're already screwed unless you use your password database on a separate machine.

Re: LessPass: sync-less open source password manager

#153

Post by guillaume20100 »

corobo wrote: post #4

What happens when the method of creating passwords needs updating, do I then need to visit countless numbers of sites to change the password? I like the idea don't get me wrong, I just can't see all of the downsides right now which will stop me using it. Elephant in the room: Are you going to be sued by lastpass for the name?

We are not a danger to LastPass. We'll see in time if it happens. The idea came after using KeePass -> I want to keep less passwords -> lesspass -> lesspass.com is available -> done

Re: LessPass: sync-less open source password manager

#154

Post by palant »

croon wrote: post #8

Others have expressed most of them, but issues I see with this is: * Algorithm can't be changed/improved without changing all your passwords. * Your master password can't be changed without changing all your passwords. * You have to remember yourself at what sites you are already registered, and in case of critical bug, you would perhaps need to change password at some services (again remembering which ones they were…

For reference, I am the author of Easy Passwords extension which uses a very similar concept.

These issues are definitely solvable, at least if you use a hybrid concept: while most passwords are generated, some can be encrypted and stored (encryption key derived from the master password). Easy Passwords has this functionality and LessPass appears to be working on it as well. Then changing algorithm or master password can be done by converting all existing generated passwords into stored password. This isn't a great solution of course and so far I haven't seen the need to implement this escape hatch but it can be done if absolutely necessary.

As to remembering the websites where you registered - that should definitely be the job of the extension (not storing passwords doesn't mean that you cannot store metadata). And many password generators support a revision counter for passwords, you increase it when you need a new password.

Re: LessPass: sync-less open source password manager

#155

Post by guillaume20100 »

sonofgod wrote: post #87

Don't use this if you're ever going to type in a password where the screen might be shared -- the constantly-updating "is my password correct" glyphs give away enough information to make it super trivial to decode by eye. PS: the password for the demonstration gif is "passwordpassword"

@dragondave on github open an issue https://github.com/lesspass/lesspass/issues/48. We are working on it.

Re: LessPass: sync-less open source password manager

#156

Post by fps »

We need to re-think passwords. Password re-use is a big problem for technical and non-technical users alike, because managing a unique generated password between devices is hard. Dealing with password managers and syncing password lists back and forth is super frustrating to users. None of the existing tools work quickly and easily on all the different devices a user could be using, so at some point everyone that uses a password manager is going to be stuck fighting their password manager to log into a website. The user will likely perform a password reset, which will send an email that allows the user to bypass the password entirely.

Why not provide people with a quick and easy "login by email", since this fallback is almost always available anyway? Slack does this https://auth0.com/blog/how-to-implement-slack-like-login-on-... and allows people to have accounts with no password memorization. You're not making the login any less secure - any attacker with access to a user's email can almost always perform a password reset anyway.

Re: LessPass: sync-less open source password manager

#157

Post by palant »

guillaume20100 wrote: post #111

I'm the creator of LessPass. We did not expect as many visits on our website. Thank you. We are working on: * encrypt password profiles client side. * help user change their master passwords ( https://github.com/lesspass/lesspass/issues/36 ) * mobile version( https://github.com/lesspass/lesspass/issues/6 ) Change his master password seems to be the biggest problem for many of you. We will address this problem as a pr…

I was quite surprised to see your extension, it is very similar to my Easy Passwords extension in both concept and design. I've had a brief look at the source code and I guess that it was a completely unrelated development after all?

Please increase the number of iterations, PBKDF2 with 8192 iterations is a very bad idea in year 2016. I would consider 100k iteration the lower limit, my Easy Passwords extension uses 256k. For reference, I described the threat scenario here:

https://palant.de/2016/04/20/security-considerations-for-pas...

Note that LastPass isn't a good example when it comes to security-relevant decisions. If you are interested, I published a lengthy writeup under https://security.stackexchange.com/a/137307/4778.

Re: LessPass: sync-less open source password manager

#158

Post by NickBusey »

ejcx wrote: post #104
adilparvez wrote: post #40

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html

Not to shamelessly self promote, but if you like pass but hate GPG, then I already built you a command line password manager that is almost exactly the same as pass It can securely save files, generate passwords, save passwords and optionally can sync using git. https://github.com/ejcx/passgo

As someone with basically no experience with encryption, why would someone hate GPG?

Re: LessPass: sync-less open source password manager

#159

Post by whyever »

jimktrains2 wrote: post #136
JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

5) You can't change the password (I guess they could include a counter, but then you need to remember or sync that.)

There is indeed a counter, with the shortcomings you mentioned.

Re: LessPass: sync-less open source password manager

#160

Post by homakov »

problems wrote: post #149
obi1kenobi wrote: post #133

Earlier quoted context omitted.

I completely agree. What makes all of it even worse is that they only use 8192 iterations of PBKDF2, based on their blog post [1]. To counter GPU-based password cracking, 100,000+ iterations are needed as of 5 years ago [2]. [1] https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4 [2] http://stackoverflow.com/questions/6054082/recommended-of-it...

Yeah, going to Scrypt or Argon2 would mitigate a lot of the GPU-based concerns while still offering reasonable in-browser performance.

Scrypt seems to be performing better in the browser because of 32 bit operations. Argon2 in browser was slow in my tests.
Post reply on HN