Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

231–240 of 247 posts

Re: LessPass: sync-less open source password manager

#231

Post by Rubiksmomo »

powercf wrote: post #143
JulianMorrison wrote: post #124

Earlier quoted context omitted.

If there's any format regularity in the output, like it's in one of the PKCS message formats, that could be detected. Or if it's a fixed length that could give it away. Webcam hack. Social engineering. Binoculars. All the things. Just sweeping them up en masse and trying popular keys.

> If there's any format regularity in the output, like it's in one of the PKCS message formats, that could be detected. After entering some junk data, and incrementing the counter field, /every/ generated password has started with one of [aeiouy], so there clearly is some regularity in the output, and I guess more if analysed in detail.

Same here, it seems like every password starts with one of these [aeiouy] characters. So it seems these passwords are not as safe as they seem. Brute force may not be necessary to break these passwords. Is there any alternative services out there that require no storage?

I posted an issue: https://github.com/lesspass/lesspass/issues/51

Re: LessPass: sync-less open source password manager

#233

Post by ZeljkoS »

JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

I completely agree. In addition to that, I use my password manager (LastPass) to:

A) Safely store confidential data like credit card information and pins.

B) Share some data with coworkers, on a folder-by-folder basis.

C) In a case something happens to me, my friend has Emergency Access after 7 days: https://helpdesk.lastpass.com/emergency-access/

Re: LessPass: sync-less open source password manager

#234

Post by 5xman »

cyphar wrote: post #196
5xman wrote: post #187

Earlier quoted context omitted.

The login you use with lesspass doesn't need to match your actual login on a web site. In fact, nothing needs to match anything real. You could use any url or alias for the service you want to access ie "Google" and you can use your real login or any other text, it doesn't matter as far as you remember it (You could use 'me' for every site, I don't know why this field is required)

Okay, but now I have to remember 3x as many things as with a managed password manager. And how do I handle having multiple accounts on the same website? "You can put whatever you want in field X" is not a solution to the problem IMO.

> how do I handle having multiple accounts on the same website?

You use the url of the site and your different logins to generate different passwords. What's so difficult about it.

Anyway, I don't think there is a problem at all.

Imagine this: I have 3 google accounts, which I use mainly for my gmail, another one for google play on my android and another one for my kids (google play, youtube). I could use the following setup: Gmail + me + masterpassword for the first one, Google Play + me + masterpassword for the second one, and Google Kids + kids + masterpassword. Another configuration could be: google + mail + pass, google + play + pass and google + kids + password. I actually would use my real login, since my accounts are already like this: username.mail@gmail.com, username.play@gmail.com, username.kids@gmail.com.

First there is nothing new to remember here, I already rememeber that I have 3 different accounts and what they are for. Second, it doesn't matter how many accounts you have on a site or how many sites you can access with the same account. You can use the url of a site and a different login for several accounts. You can use a description/purpose of your accounts and the same or different logins for several accounts on SSO services.

As I said, I don't see the problem.

Re: LessPass: sync-less open source password manager

#235

Post by SevereOverfl0w »

lucaspiller wrote: post #58
adilparvez wrote: post #40

It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html

I was using this for ~4 years and really liked it, but recently I've been using 1Password. I tried 1Password as it has a family plan, that didn't really work out though (getting non-technical people to use a password manager is hard - so I'll forever keep being asked "What's the Netflix password?"), but I have stuck with it for myself. I really like the browser integration, which there isn't anything comparable for p…

I've been using passff[0] with a lot of success for an in-browser pass client with filling support and so on. Works really well.

My understanding is that Chrome makes it difficult to have this kind of thing due to it's sandbox. There was some talk of exposing pass over the network locally so there were no sandbox concerns.

[0] https://github.com/nwallace/passff

Re: LessPass: sync-less open source password manager

#237

Post by atemerev »

blueplanet200 wrote: post #210
atemerev wrote: post #142

Earlier quoted context omitted.

Lastpass is something I have no control of. Leaks can happen (already have: https://blog.lastpass.com/2015/06/lastpass-security-notice.h... ). More importantly, DDoS can happen, and I will be out of access to everything.

Lastpass stores your password encrypted. If in your threat model you're unwilling to use Lastpass because of the leakability of the master database, you should avoid Lesspass since trying to guess your password on Webstie X given Lastpass database is more/less the same as trying to guess it given you're using Lesspass.

Like I said before, leakability of master database is not that big concern. DDoS on Lastpass, however, is a very likely scenario, especially in the light of recent high-profile DDoS attacks.

Re: LessPass: sync-less open source password manager

#238

Post by xpil »

atemerev wrote: post #237
blueplanet200 wrote: post #210

Earlier quoted context omitted.

Lastpass stores your password encrypted. If in your threat model you're unwilling to use Lastpass because of the leakability of the master database, you should avoid Lesspass since trying to guess your password on Webstie X given Lastpass database is more/less the same as trying to guess it given you're using Lesspass.

Like I said before, leakability of master database is not that big concern. DDoS on Lastpass, however, is a very likely scenario, especially in the light of recent high-profile DDoS attacks.

DDoS on LastPass is not a big deal as long as you have at least one device logged on. LastPass database is stored locally and can be used off-line.

Re: LessPass: sync-less open source password manager

#239

Post by arantius »

I did roughly the same thing twelve years ago, with even less security built in (hey, I was young(er)):

https://bookmarklets.arantius.com/password+maker+bookmarklet

I did not market it so heavily. It has the same problems, most importantly rotation. As soon as you want to rotate one site's password the only option is to change the "master" password, but now you need to remember which site uses which master password, and your utility is gone. The random site requirements, as mentioned, is also a big deal.

Re: LessPass: sync-less open source password manager

#240

Post by spb »

sonofgod wrote: post #87

Don't use this if you're ever going to type in a password where the screen might be shared -- the constantly-updating "is my password correct" glyphs give away enough information to make it super trivial to decode by eye. PS: the password for the demonstration gif is "passwordpassword"

This is why I designed the similarly-updating glyphs in surpass (https://stuartpb.github.io/surpass/demo.html) to only update after a half-second delay when masked.
Post reply on HN