3 ms·
While the idea sounds alright (and I've seen similar ideas done before), there are a few problems with this system that make me quite cautious about trying it:
by cyphar 10y ago
While the idea sounds alright (and I've seen similar ideas done before), there are a few problems with this system that make me quite cautious about trying it:
* In order to handle different password complexities, regeneration of passwords and similar setting, you have to use a "connected" version (read: you have to store the configuration). In addition, the configuration they have includes potentially sensitive information (password length, number of times password was changed, list of websites I use, my username on the site). And currently those profiles are unencrypted. So you in order for it to be useful it's no longer sync-less. As an aside, my bank (foolishly) uses my generated username as a "privileged" piece of information -- which means that I literally could not use this manager for my bank.
* You can't change your master password without updating all of your site passwords. This also means you can't import your old passwords without just changing them all. IMO this makes LessPass not a password "manager". It's a password generator.
* Also, the profile doesn't appear to contain any configuration details for the PBKDF, which seems like a bad idea (it means that they can never practically update the PBKDF without introducing backwards compatibility in the profile settings). Also not sure why they're using SHA when there are better password hashing algorithms.
* Aliases are impossible to implement (without adding more information to the profile), which just makes this impossible to use with SSO systems (I'm not going to remember which of the 5 different hostnames I used to generate a password I use once a year).
I've got to admit that I kinda like the symbols shown next to your password to make sure you're using the right master password, but there doesn't seem to be any description how that's generated. My guess is that it's similar to SSH keyart (which then brings up the question how often will collisions happen with only X^3 options, and can you have two passwords result in different orderings of the same tokens).
Overall, seems like an okay idea. But I would prefer if someone just offered a nice way to host your KeePass databases (or rather if there was an app that did it). You could probably do it with git and push to GitLab or something, but that is just ugly to do manually.
- 5xman 10y agoThe login you use with lesspass doesn't need to match your actual login on a web site. In fact, nothing needs to match anything real. You could use any url or alias for the service you want to access ie "Google" and you can use your real login or any other text, it doesn't matter as far as you remember it (You could use 'me' for every site, I don't know why this field is required)
- cyphar 10y agoOkay, but now I have to remember 3x as many things as with a managed password manager. And how do I handle having multiple accounts on the same website? "You can put whatever you want in field X" is not a solution to the problem IMO.
- 5xman 10y ago> how do I handle having multiple accounts on the same website? You use the url of the site and your different logins to generate different passwords. What's so difficult about it. Anyway, I don't think there is a problem at all. Imagine this: I have 3 google accounts, which I use mainly for my gmail, another one for google play on my android and another one for my kids (google play, youtube). I could use the following setup: Gmail + me + masterpassword for the first one, Google Play + me + masterpassword for the second one, and Google Kids + kids + masterpassword. Another configuration could be: google + mail + pass, google + play + pass and google + kids + password. I actually would use my real login, since my accounts are already like this: username.mail@gmail.com, username.play@gmail.com, username.kids@gmail.com. First there is nothing new to remember here, I already rememeber that I have 3 different accounts and what they are for. Second, it doesn't matter how many accounts you have on a site or how many sites you can access with the same account. You can use the url of a site and a different login for several accounts. You can use a description/purpose of your accounts and the same or different logins for several accounts on SSO services. As I said, I don't see the problem.
- cyphar 10y ago> You use the url of the site and your different logins to generate different passwords. What's so difficult about it. Your suggested solution of "not using your actual login" requires me to remember something that is not related to my login. This means that for multiple different accounts I need to remember twice as many things. Which makes it impractical (they can't be linked to my account or else my profiles will reveal the information). > Imagine this: I have 3 google accounts, ... I have ~8 different gmail accounts, all of which are used for emails. Yes, they're for different purposes but your scheme won't help differentiate them without also giving away my logins.