Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

161–170 of 247 posts

Re: LessPass: sync-less open source password manager

#161

Post by guillaume20100 »

palant wrote: post #157
guillaume20100 wrote: post #111

I'm the creator of LessPass. We did not expect as many visits on our website. Thank you. We are working on: * encrypt password profiles client side. * help user change their master passwords ( https://github.com/lesspass/lesspass/issues/36 ) * mobile version( https://github.com/lesspass/lesspass/issues/6 ) Change his master password seems to be the biggest problem for many of you. We will address this problem as a pr…

I was quite surprised to see your extension, it is very similar to my Easy Passwords extension in both concept and design. I've had a brief look at the source code and I guess that it was a completely unrelated development after all? Please increase the number of iterations, PBKDF2 with 8192 iterations is a very bad idea in year 2016. I would consider 100k iteration the lower limit, my Easy Passwords extension uses 2…

Hi Palant, I found your app in the comment today. So yes, LessPass was developed it independently.

And yes we are working in a way to change the number of rounds of PBKDF2. https://github.com/lesspass/lesspass/issues/38

API already evolve (https://github.com/lesspass/core/commit/70bebd5e5bcd0c9a32ac...), we are updating the user interface.

Re: LessPass: sync-less open source password manager

#162

Post by ekiru »

The _prettyPrint [1] and _getPasswordTemplate [2] functions they use to get from the HMAC to the actual password seem to have a lot of issues:

- _prettyPrint calls into _getPasswordChar which will then take the character code modulo the length of the array of possible characters [3], which is usually going to be biased if the character code is not uniformly distributed between 0 (inclusive) and a multiple of the length (exclusive).

- It's even worse because the input to _prettyPrint is the HMAC encoded as a hexadecimal string. The impact of this depends on the size of the possible character array, but in several cases, some of the options can never be chosen and others will be chosen twice as often as others that can be chosen.

- Using the hex encoding also drastically reduces the number of possibilities for a given length even if that input was then used in a less flawed fashion.

- _getPasswordTemplate appears to treat a password with lowercase/uppercase letters as a series of alternating vowels and consonants (by appending 'vc' or 'VC' to the password template).

- It also generally seems to define "password containing X and Y char types" as "password containing X char type, then Y char type, then X, then Y, and so on".

[1]: https://github.com/lesspass/core/blob/master/lib/index.js#L8...

[2]: https://github.com/lesspass/core/blob/master/lib/index.js#L6...

[3]: https://github.com/lesspass/core/blob/master/lib/index.js#L1...

Re: LessPass: sync-less open source password manager

#164

Post by cyphar »

homakov wrote: post #160
problems wrote: post #149

Earlier quoted context omitted.

Yeah, going to Scrypt or Argon2 would mitigate a lot of the GPU-based concerns while still offering reasonable in-browser performance.

Scrypt seems to be performing better in the browser because of 32 bit operations. Argon2 in browser was slow in my tests.

Slow is good for a password hashing function. :P

Re: LessPass: sync-less open source password manager

#165

Post by palant »

fnj wrote: post #29

When I find stuff like this that uses SHA256, I instantly just tune out. SHA256 is stupid. Use SHA512 or find another line of work. SHA512 is astronomically more secure. Anyone who is using anything less than SHA512 for hashing is an idiot.

SHA512 is astronomically more secure how exactly? Under which scenarios?

Just so you know: SHA1 is problematic because of potential collision attacks. So you should definitely not use SHA1 for signing anything because it might be possible to construct a different document with the same signature. That's it.

What does it have to do with password derivation? Nothing at all. Collision attacks are irrelevant, what matters is computational complexity. So if you use PBKDF2-HMAC-SHA1 the only thing that would make your solution less secure is some shortcut allowing to compute a SHA1 hash radically faster without throwing faster hardware at it. And so far nobody found one.

Since you seem to like name calling, what do you call somebody making authoritative statements on matters they don't understand?

For reference, I am the author of Easy Passwords extension which uses a concept similar to LessPass. And it also uses SHA1 - for technical reasons.

Re: LessPass: sync-less open source password manager

#166

Post by adilparvez »

omtose wrote: post #137
adilparvez wrote: post #108

Earlier quoted context omitted.

Yes, under that threat model you would lose with all of these password managers.

How so? If the entire directory structure is also encrypted then no program can easily know which sites or services I have passwords for.

I was meaning if your machine was compromised.

Re: LessPass: sync-less open source password manager

#167

Post by whyever »

fps wrote: post #156

We need to re-think passwords. Password re-use is a big problem for technical and non-technical users alike, because managing a unique generated password between devices is hard. Dealing with password managers and syncing password lists back and forth is super frustrating to users. None of the existing tools work quickly and easily on all the different devices a user could be using, so at some point everyone that use…

> Why not provide people with a quick and easy "login by email", since this fallback is almost always available anyway?

There was Mozilla's Persona (which was shut down a few days ago). Now there is this:

https://portier.github.io/

Re: LessPass: sync-less open source password manager

#168

Post by cyphar »

NickBusey wrote: post #158
ejcx wrote: post #104

Earlier quoted context omitted.

Not to shamelessly self promote, but if you like pass but hate GPG, then I already built you a command line password manager that is almost exactly the same as pass It can securely save files, generate passwords, save passwords and optionally can sync using git. https://github.com/ejcx/passgo

As someone with basically no experience with encryption, why would someone hate GPG?

GPG is well known to have a very clunky interface. It also is based on very old crypto (we know it works against the NSA, but we also know that it has problems that other crypto doesn't).

Re: LessPass: sync-less open source password manager

#170

Post by ohstopitu »

porker wrote: post #105
ohstopitu wrote: post #96

Earlier quoted context omitted.

After lastpass was bought out, I went on a spree to find a different password manager and in that process, I tried almost all of them (free & paid). Nothing came close to Lastpass so I decided to stick with them until they mess up. If the worst comes to worst, I'll probably move to Dashlane (which is significantly more expensive & a bit more work to use - extensions won't work without a desktop app)

Why were Lastpass and Dashlane better than 1Password for you? I've used 1P for a few years without looking at the competition, so curious to hear what they can do.

I did try 1Password, and while it was pretty good, it was never "great". By that I mean,

1. It required a desktop app to be installed to use the clients (while this is an issue with Dashlane, the 1Password windows desktop client is just weird - looks outdated, crashes etc.)

2. The 1Password Android app seemed to not have in-app password fill in (which both Dashlane & Lastpass had). While it's not too much of an inconvenience, I feel like 1Password is great if you are in the apple ecosystem.

This is not to say 1Password is "bad" by any means...I loved it's dropbox sync feature for example and it's integration with Alfred on Mac was awesome!

Post reply on HN