Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

221–230 of 247 posts

Re: LessPass: sync-less open source password manager

#221

Post by problems »

StavrosK wrote: post #217
problems wrote: post #152

Earlier quoted context omitted.

> 3) If someone has a keylogger or otherwise steals your master password, you're done for everywhere. This is not so with password databases, because the attacker also needs the file. It's about equivalent though. If someone can keylog you, they can probably obtain the file. If that's through malware then they simply grab the file with the malware, if that's through a hardware keylogger then they just grab it off you…

Sure, a much more plausible model is that you reuse the master password somewhere vulnerable and it's game over.

But that's trivially mitigated - don't.

Re: LessPass: sync-less open source password manager

#223

Post by Ar-Curunir »

TuringTest wrote: post #114
sixhobbits wrote: post #106

Earlier quoted context omitted.

Well there are different levels of description here. First, I think I am pretty representative of the target audience for the main website (it's sad, but most non technical people still don't know what a password manager is or why they might want to use one). Second, there is a difference between "What it does" (A password manager that re-computes the same site-specific password on every use, meaning that no syncing…

> First, I think I am pretty representative of the target audience for the main website (it's sad, but most non technical people still don't know what a password manager is or why they might want to use one). Maybe they're trying to make a website for non technical people, in order to gain some traction among that audience? If developers keep pandering to the technical audience who already knows enough about the purp…

Plain terms doesn't mean meanless terms. Having meaningless marketing buzzwords is not useful. You can explain things simply and clearly without resorting to vagueness.

Re: LessPass: sync-less open source password manager

#224

Post by ahazred8ta »

JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

Oy... The generated passwords are a repeating sequence like abCD9?wxYZ7% - the aaZZ9+ pattern repeats and the keyspace is smaller than it should be.

Re: LessPass: sync-less open source password manager

#225

Post by developer2 »

lucaspiller wrote: post #58
adilparvez wrote: post #40

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html

I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…

>> 1Password also supports TOTP, so you don't need a seperate app for that - although for security you probably should.

It goes way beyond "probably should" regarding security. You're giving a single company not only potential access to your usernames and passwords, but also your last line of defense - TOTP generation. That combination of apps put everything in reach of one company to fuck you over.

Using a password manager that is being coded and maintained by a random everyday software company should be the only concern anyone has over even considering using such an app. That one company has the ability - whether intentionally or via being hacked - to release an update to any of their client apps that sends your entire database, decrypted to plaintext, to any server in the world.

Can you think of any scenario where someone slips in a 2-line commit to one of their client apps that sends your decrypted database to any server of their choice? We're talking about one disgruntled employee who decides they would like access to millions of users' most sensitive credentials. Or perhaps a single firewall opening or social engineering attack away.

It blows my mind that anyone would put this much trust in any for-profit password manager. Every month we hear about yet another major hack against software companies. One day soon, such a hack will happen to 1Password or LastPass, and the majority of their customers are going to have their entire lives (logins to bank accounts, government portals, etc.) exposed.

Such an eventuality cannot be defended against. It will start and end in less than 48 hours thanks to auto-updating applications, and will affect millions.

Re: LessPass: sync-less open source password manager

#226

Post by bartvk »

chakalakasp wrote: post #220
gnicholas wrote: post #206

Earlier quoted context omitted.

Schwab used to have (and may still) a maximum password length of 8 chars. Crazy—especially for a site with financial/sensitive information.

Good ol' hunter2, I use it for all my logins

> Good ol' * * * * * * * *, I use it for all my logins

hey, if you type in your pw, it will show as stars

Re: LessPass: sync-less open source password manager

#227

Post by MaKleSoft »

JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

Came here to point out the same concerns, basically. I'll add this:

5. Its seems like there is no user-specific secret in addition to the master password. If two users happen to use the same master password (which is definitely a possibility, especially with weak or easily memorizable passwords) they will basically have all the same passwords for every site!

6. Rotating your passwords regularly, at least for your highly sensitive accounts, is very important. With this approach, you can't change any one of your passwords without changing the whole lot (i.e. changing your master password) which simply isn't practical.

7. They serve the whole thing over the web, which, as has been pointed out many times over the web[1], is a bad idea.

Overall, its seems like they are looking for a overly simplistic solution for a complicated problem.

Padlock[2] is a penetration-tested, open source password manager that, while using a battle-tested, 'conventional' encryption scheme for securing data, still tries to be forward thinking and to improve on the overall user experience of other password managers.

[1]https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...

[2]: https://padlock.io

Re: LessPass: sync-less open source password manager

#228

Post by palant »

MaKleSoft wrote: post #227
JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

Came here to point out the same concerns, basically. I'll add this: 5. Its seems like there is no user-specific secret in addition to the master password. If two users happen to use the same master password (which is definitely a possibility, especially with weak or easily memorizable passwords) they will basically have all the same passwords for every site! 6. Rotating your passwords regularly, at least for your hig…

For reference, I am the author of the Easy Passwords extension which uses a similar concept.

5. The user-specific part is the user name. As long as these two users don't use the same user names they won't have the same passwords.

6. Password generators typically solve this by implementing a revision counter that you can increase in order to generate a new password. LessPass has this functionality, can be seen in screenshots.

7. What is served over the web? LessPass is a browser extension, the page you see in screenshots is contained in the extension.

I obviously disagree with your conclusion. Password generators are a very nice tool, and LessPass isn't currently using the full potential of the idea. For example, Easy Passwords allows you to create a "paper backup" of your passwords - all the password metadata (website, user name, password length) is safe to be printed, yet as long as you remember your master password it is sufficient to recreate your passwords. Of course, occasionally you simply cannot change a password which is why Easy Passwords has a hybrid concept and allows storing some passwords in encrypted form (no paper backup there).

Re: LessPass: sync-less open source password manager

#229

Post by MaKleSoft »

palant wrote: post #228
MaKleSoft wrote: post #227

Earlier quoted context omitted.

Came here to point out the same concerns, basically. I'll add this: 5. Its seems like there is no user-specific secret in addition to the master password. If two users happen to use the same master password (which is definitely a possibility, especially with weak or easily memorizable passwords) they will basically have all the same passwords for every site! 6. Rotating your passwords regularly, at least for your hig…

For reference, I am the author of the Easy Passwords extension which uses a similar concept. 5. The user-specific part is the user name. As long as these two users don't use the same user names they won't have the same passwords. 6. Password generators typically solve this by implementing a revision counter that you can increase in order to generate a new password. LessPass has this functionality, can be seen in scre…

Thanks for adding some clarity here. Apparently I missed some of the finer details.

> What is served over the web?

There is a form for generating passwords right on the front page and it states nowhere that the browser extensions are the more secure / recommended way of using the tool.

Re: LessPass: sync-less open source password manager

#230

Post by palant »

MaKleSoft wrote: post #229
palant wrote: post #228

Earlier quoted context omitted.

For reference, I am the author of the Easy Passwords extension which uses a similar concept. 5. The user-specific part is the user name. As long as these two users don't use the same user names they won't have the same passwords. 6. Password generators typically solve this by implementing a revision counter that you can increase in order to generate a new password. LessPass has this functionality, can be seen in scre…

Thanks for adding some clarity here. Apparently I missed some of the finer details. > What is served over the web? There is a form for generating passwords right on the front page and it states nowhere that the browser extensions are the more secure / recommended way of using the tool.

Ah, I see. Yes, I have a similar one for Easy Passwords under https://palant.github.io/easypasswords/online.html - but it has a huge warning on it. This is not secure indeed and the recommended way of using that page if you absolutely have to is downloading it to your hard drive.
Post reply on HN