At last, a simple software project a beginner can understand.
LessPass: sync-less open source password manager
171–180 of 247 posts
Re: LessPass: sync-less open source password manager
#172Earlier quoted context omitted.
These weaknesses all hold if it's discovered that lesspass is in use. How would information that the user is using lesspass leak?
The GP's points are all a bit weak, especially if this method uses a good KDF like bcrypt to generate the keys. I used SuperGenPass for a while, before switching to KeePass, and the major drawbacks I found were: 1) No way to change a password. None at all. If a site required you to make up a new password, you're out of luck (or you have to come up with a new master password every time and remember which master passwo…
#2 - the password generation options are part of the input to the generation function for LessPass. Problem of course is that you have to either remember those or store them somewhere, at which point you might as well store the password database.
Re: LessPass: sync-less open source password manager
#173Re: LessPass: sync-less open source password manager
#174Earlier quoted context omitted.
Scrypt seems to be performing better in the browser because of 32 bit operations. Argon2 in browser was slow in my tests.
Slow is good for a password hashing function. :P
No. You don't want to use an unnecessarily slow PB-KDF in your daily operations, because that means that the ratio your_speed / attackers_speed is worse.
In other words, you want the KDF that is slowest for an attacker that still completes a KD in, say, 0.5 seconds on your devices.
Re: LessPass: sync-less open source password manager
#175How do you deal with sites whose password requirements don't match the output of LessPass? How do you handle the fact that sites want you to change your password? Yes. There's a counter field, but how do you know what site uses what version of the counter? How do you change the master password without having to change all passwords? Thing is: There's a solution for all these problems: All you have to do is actually g…
The problem with writing passwords down is that I need to fly places and it's not unheard of if you work in financial tech or military tech to have your things riffled through at the boarder. Plus a mugger can say "give me your things!" or "Empty your pockets!" and now he has my credentials. Passwords are not easy. My current solution for the long tail of things that need passwords is two factor + really strong passw…
If you used any stateful password manager instead of a piece of paper, then the passwords would be stored in an encrypted fashion. Don't give out your master password and your passwords are useless to an attacker.
If you use a paper based solution, just alter the passwords you write down using some additional information only known to you - maybe some prefix or suffix and the list would be useless for an attacker.
If you think they can force you to divulge the master password or your password scheme if you're using paper (they probably can, see https://xkcd.com/538/), then LessPass won't be of any help to you either.
Re: LessPass: sync-less open source password manager
#176I used to use SuperGenPass[1] to do exactly this, but what you'll soon find is that every website has slightly different password rules, so you'll have to start memorizing unique settings for each site (i.e. website X can't have certain chars, website Y can't be longer than 12 chars, etc...). Then you run into the issue of multiple things you need to remember, such as secret answers for various questions, birthdays that you may lie about, etc...
Much easier to just use a vault to store all this.
Re: LessPass: sync-less open source password manager
#177What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…
I think these concerns are slightly misleading. 2., 3. and 4. boil down to 1.
1. is a problem. If one password is compromised it is possible to brute force the master password. This is mitigated by a key-derivation function.
2. is also mitigated by a key-derivation function. Also you still need to test the guesses, which requires knowing one password or trying to log into a website. The second option should be equivalent to compromising one password via brute force.
3. is not true, they need to know a password or try to log into a website for every guess.
4. Again, this is only true if one site password is compromised.
Re: LessPass: sync-less open source password manager
#178Earlier quoted context omitted.
Slow is good for a password hashing function. :P
No. You don't want to use an unnecessarily slow PB-KDF in your daily operations, because that means that the ratio your_speed / attackers_speed is worse . In other words, you want the KDF that is slowest for an attacker that still completes a KD in, say, 0.5 seconds on your devices.
If it takes 1 sec on my device and 1 year on attackers
versus
If it takes 2 sec on my device and 2 years on attackers
My conclusion
I will spend one second of my life for each login I do, but I'll gain 1 year of security (or the attacker will have to double his power).
Perhaps 5 years to generate, 5 years to break isn't usefull (and the ratio would be terrible).
But keeping the same ratio, or even making it a little worse when it makes the attacker take longer, doesn't seem bad.
Re: LessPass: sync-less open source password manager
#179Earlier quoted context omitted.
I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…
>I really like the browser integration, which there isn't anything comparable for pass. people keep saying stuff like this (the one i use because x feature has no real competitor) lastpass. i've used most password managers out there and lastpass hits all these points and more
Command line interface with (or without, for that matter) X integration, and Open Source would be two features it seems to lack.
Re: LessPass: sync-less open source password manager
#180[deleted]