Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LessPass: sync-less open source password manager

lesspass.com

Post reply on HN
Print view View original

201–210 of 247 posts

Re: LessPass: sync-less open source password manager

#201

Post by palant »

guillaume20100 wrote: post #161
palant wrote: post #157

Earlier quoted context omitted.

I was quite surprised to see your extension, it is very similar to my Easy Passwords extension in both concept and design. I've had a brief look at the source code and I guess that it was a completely unrelated development after all? Please increase the number of iterations, PBKDF2 with 8192 iterations is a very bad idea in year 2016. I would consider 100k iteration the lower limit, my Easy Passwords extension uses 2…

Hi Palant, I found your app in the comment today. So yes, LessPass was developed it independently. And yes we are working in a way to change the number of rounds of PBKDF2. https://github.com/lesspass/lesspass/issues/38 API already evolve ( https://github.com/lesspass/core/commit/70bebd5e5bcd0c9a32ac... ), we are updating the user interface.

I don't think that this is sufficient as long as 8192 is still the default. Personally, I don't think that exposing the number of iteration is a good idea at all - users have no way of knowing how much is enough. Frankly, it took me quite a while to find out what contemporary hardware (especially GPUs) is capable of and how many iterations should be considered safe today.

Re: LessPass: sync-less open source password manager

#202

Post by homulilly »

JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

Additionally,

You can't change your master password unless you go and change every single password you use.

You won't be able to use it on sites with abnormal password requirements (usually bad practices on the part of the site admins but that doesn't mean you can just ignore it).

Re: LessPass: sync-less open source password manager

#203

Post by hellofunk »

One issue with this is that URLs for sites can, and in my experience, often do, change, while logins remain the same. A password that uses the URL/site itself may no longer work unless you can remember the old site. That's a headache. I used to have my own mental model of generating a password based on a URL, and it eventually failed several times over because of this issue.

Re: LessPass: sync-less open source password manager

#204

Post by z3t4 »

Ajedi32 wrote: post #135
z3t4 wrote: post #101

Earlier quoted context omitted.

It's important to change your passwords at regular intervals, even if you use a secure one. If you compare this to two factor authentication it's the same amount of extra work, but without the benefits. You should also avoid copying passwords to the clipboard as many applications and even web sites might have access to it. Too bad client certifications are deprecated, now when SSL/TSL is becoming more and more popula…

There's also some privacy and UX concerns with client certs. See http://www.browserauth.net/tls-client-authentication Personally I'd love to see UAF or SQRL take off. Lots of potential there.

most browsers will auto select the right cert. But for browsers that dont support the keygen tag you have to create the cert including priv key and pw. you can of course create many certs for different users, you can of course also sign them yourself, no ca is needed besides for the ssl server cert. most of the points on that site is moot besides poor support on some browsers.

Re: LessPass: sync-less open source password manager

#205

Post by fapjacks »

Nux wrote: post #90

Nice idea and willing to try it, but.. "The requirement for self-hosting is to have docker and docker-compose installed on your machine." Fsck that. If I will trust this with my passwords, I need to know how to _really_ install it. I can't trust you if all you have to offer is a steaming pile of docker or your idea of how I should run my systems.

If you knew anything about the applications you disparage, you would know how to take a Dockerfile and docker-compose.yml file and determine exactly how to install it on your system. Since that's what they do.

Re: LessPass: sync-less open source password manager

#206

Post by gnicholas »

homulilly wrote: post #202
JulianMorrison wrote: post #102

What this seems to be, in essence: password = HMAC(key, website). Why this is bad, compared to an encrypted on-disk key store: 1. A password is now ciphertext, not a block of line noise. Every time you transmit it, you are giving away potential clues of use to an attacker. 2. The search space for possible passwords is bounded if you know the website. You are subject to key guessing attacks. If your key is short, pure…

Additionally, You can't change your master password unless you go and change every single password you use. You won't be able to use it on sites with abnormal password requirements (usually bad practices on the part of the site admins but that doesn't mean you can just ignore it).

Schwab used to have (and may still) a maximum password length of 8 chars. Crazy—especially for a site with financial/sensitive information.

Re: LessPass: sync-less open source password manager

#207

Post by leepowers »

Aside from the security concerns already noted I have two major questions:

1) How do I change my master password? It appears that all generated passwords would change as well. Even master passwords should be expirable and changeable.

2) I don't just use a password manager to manage passwords. I use it to manage _credentials_. I have a ton of credentials, so I need something that will remember the _usernames_ for me as well. Otherwise I don't just have to memorize the master password - I also have to memorize the usernames for the hundreds of different logins I'm managing. That's a non-starter.

Re: LessPass: sync-less open source password manager

#208

Post by whyever »

fooyc wrote: post #193
whyever wrote: post #177

Earlier quoted context omitted.

I think these concerns are slightly misleading. 2., 3. and 4. boil down to 1. 1. is a problem. If one password is compromised it is possible to brute force the master password. This is mitigated by a key-derivation function. 2. is also mitigated by a key-derivation function. Also you still need to test the guesses, which requires knowing one password or trying to log into a website. The second option should be equiva…

You are assuming that the site is not evil.

The site being evil is equivalent to the password being compromised.

Re: LessPass: sync-less open source password manager

#210

Post by blueplanet200 »

atemerev wrote: post #142
teach wrote: post #138

Earlier quoted context omitted.

What's wrong with something like Lastpass?

Lastpass is something I have no control of. Leaks can happen (already have: https://blog.lastpass.com/2015/06/lastpass-security-notice.h... ). More importantly, DDoS can happen, and I will be out of access to everything.

Lastpass stores your password encrypted. If in your threat model you're unwilling to use Lastpass because of the leakability of the master database, you should avoid Lesspass since trying to guess your password on Webstie X given Lastpass database is more/less the same as trying to guess it given you're using Lesspass.
Post reply on HN