How do you deal with sites whose password requirements don't match the output of LessPass? How do you handle the fact that sites want you to change your password? Yes. There's a counter field, but how do you know what site uses what version of the counter? How do you change the master password without having to change all passwords? Thing is: There's a solution for all these problems: All you have to do is actually g…
> But if you have storage for the special cases, why not just store the passwords to begin with?
1. because compromises do not give up the password
2. because storage then becomes optional, it's still usable if it's not installed on the device you're using, as long as you remember the metadata. (or keep trying different combinations until you get it, there aren't that many different combinations as long as you rarely increment a counter).
I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features . No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and sc…
If it's open source, how can you hope you achieve security through obscurity?
evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they start trying to crack the more difficult ones. GPUs come out and some fancy machine learning. Then they do some specialised stuff, like implementing the LessPass open source function to start trying to crack LessPass specific passwords. This is now as difficult to crack as your master password for LessPass, but it's "security through obscurity" because they have to guess that you use LessPass, and will probably only start attacking your password once all the low-hanging fruit is gone, giving you more time to change your password/ delete your affected account, etc.
I don't know what these are used for, but secret keys generated from current time are easy to guess. You only have to try around 2^24 values if you can estimate installation time within a specific year. https://github.com/lesspass/lesspass/blob/master/lesspass.sh...
I always wondered why people resorted to `date(1)` when there's `random(4)`:
I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features . No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and sc…
I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password"): http://grisha.org/blog/2013/05/31/simple-solution-to-passwor...
Considering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)
It's great people are exploring this problem space, but so far nothing comes close to https://www.passwordstore.org/ which is just a wrapper around gpg and git. It has Android/iOS clients, as well as GUI clients. On Android I use Password Store + OpenKeychain, the UX with a YubiKey is very smooth. https://fossdroid.com/a/openkeychain.html https://fossdroid.com/a/password-store.html
I'm also a user of pass, but the fact that all the metadata is in clear is a big beef for me. How do you solve that, if at all?
You can use a hash of the site appended with a .pass wide pepper as the name of the directory storing credentials for a particular site, then use a wrapper script that hashes its input before passing it to pass.
I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features . No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and sc…
Obviously you are not the target audience for the main website; it explains how it works in general terms, i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective.
I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how to use it properly.
You probably should jump directly to the github project page[1], where you'll find that kind of technical description that you were expecting and didn't find.
Don't use this if you're ever going to type in a password where the screen might be shared -- the constantly-updating "is my password correct" glyphs give away enough information to make it super trivial to decode by eye.
PS: the password for the demonstration gif is "passwordpassword"
It generates passwords based on a secret key ("seed") and memorized transformations to URLs. You can adapt that to use a master password, if you so desire, by using a password as a base for such a transformation, but that's not built in.
I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password"): http://grisha.org/blog/2013/05/31/simple-solution-to-passwor...
Considering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)
Lol - that's what happens when posting on a Monday before finishing the morning coffee.
Someone commented on my article then that you can pretty much accomplish this from the command line with:
> echo "masterpassword gmail" | md5
(Ignoring the implication of the password potentially getting logged in shell history, of course.)
"The requirement for self-hosting is to have docker and docker-compose installed on your machine."
Fsck that.
If I will trust this with my passwords, I need to know how to _really_ install it. I can't trust you if all you have to offer is a steaming pile of docker or your idea of how I should run my systems.