4 ms·

I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features. No sync, but access anywher

I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features. No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and scrolling past a bullet list and stylised quotation, we get "The trick is to compute passwords rather than generate and store random passwords. LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know." "Next-gen", "Anywhere, anytime", "Manage directly from your browser". These are all super cliched, really cheap phrases that I really dislike. The front page is full of them. If you're marketing a luxury yacht trip to people with more money than sense, then sure you're probably going to get good results by writing like this. But the folk reading about this are going to be pretty technical and I'm sure everyone would appreciate to see something like "We provide a function that generates a memorable password from the site name and your master password" on the front page, above the fold. In terms of entropy, you may as well come up with your own function. Security through obscurity is bad (no one knows the function you use to generate site specific passwords) but it's better than security through less obscurity (use a public function that a bunch of other people are using). You can't get free entropy. If you care about your passwords not being broken when a database of hashes is dumped, you need to use a long, securely generated, random password. Sure, this is better than using the same password everywhere, but it's not really an alternative to something that uses proven cryptography to generate secure unique passwords. Passwords generated using this are only as good as your master password, with some obscurity thrown in.

michaelmior 10y ago
If it's open source, how can you hope you achieve security through obscurity?
- sixhobbits 10y ago
  evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they start trying to crack the more difficult ones. GPUs come out and some fancy machine learning. Then they do some specialised stuff, like implementing the LessPass open source function to start trying to crack LessPass specific passwords. This is now as difficult to crack as your master password for LessPass, but it's "security through obscurity" because they have to guess that you use LessPass, and will probably only start attacking your password once all the low-hanging fruit is gone, giving you more time to change your password/ delete your affected account, etc.
  - stinkytaco 10y ago
    As someone pointed out above, the problem with this argument is that the password becomes cipher text. That means that each time it is gathered by an attacker it gets easier to compromise. For most of us, this is not an issue because there is so much low hanging fruit. For some -- say a celebrity or person of public interest -- this could be a serious problem as they are already the target of a focused effort.
    - whyever 10y ago
      > That means that each time it is gathered by an attacker it gets easier to compromise. I don't think this is relevant. You still need to inverse the key-derivation function. If you know a hundred passwords, this will be technically easier than if you know one password, but it should not matter if the security margin of the key-derivation function is high enough.
rco8786 10y ago
Agree with thought on implementation, but at least on mobile the. It about how it actually works is right below the first few marketing blurbs. Not that egregious.
gtrubetskoy 10y ago
I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password"): http://grisha.org/blog/2013/05/31/simple-solution-to-password-reuse/ http://grisha.org/blog/2013/05/31/simple-solution-to-passwor...
- sixhobbits 10y ago
  Considering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)
  - gtrubetskoy 10y ago
    Lol - that's what happens when posting on a Monday before finishing the morning coffee. Someone commented on my article then that you can pretty much accomplish this from the command line with: > echo "masterpassword gmail" | md5 (Ignoring the implication of the password potentially getting logged in shell history, of course.)
    - austinjp 10y ago
      Maybe try just > md5sum | cut -d" " -f1 or similar. Carriage-return followed by ctrl-D to exit. Output matches echo "whatever" | md5sum | cut -d" " -f1 in my term.
- palant 10y ago
  You better add a huge "do not use" warning to that blog post. Deriving passwords via SHA-512 or similar is a very common mistake and makes guessing your master password way too easy. I outlined the details in my blog post here: https://palant.de/2016/04/20/security-considerations-for-password-generators https://palant.de/2016/04/20/security-considerations-for-pas... No, LessPass uses PBKDF2 which is already a lot better than merely SHA-512. However, with 8192 iterations it still makes guessing the master password too easy.
TuringTest 10y ago
Obviously you are not the target audience for the main website; it explains how it works in general terms, i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective. I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how to use it properly. You probably should jump directly to the github project page[1], where you'll find that kind of technical description that you were expecting and didn't find. [1] https://github.com/lesspass/lesspass https://github.com/lesspass/lesspass
- appleflaxen 10y ago
  respectfully disagree. "how it works" should show you the internals "what it does" is better description if you are just going to tell me the inputs and outputs.
  - TuringTest 10y ago
    But the page does show you the internals of what it does, it's just that it's done in a very high level, enough for the non-technical people who will most benefit from that page: "The trick is to compute passwords rather than generate and store random passwords. LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know." "It does not save your passwords in a database. It does not need to sync your devices together. " "The system uses a pure function, i.e. a function that given the same parameters will always give the same result. In our case, given a login, a master password, a site and options it will returns a unique password." Etc.
    - bitJericho 10y ago
      I'm a technical person, and I thought this was a great and fast explanation to tell me what was going on. I don't need any more details than this and appreciated the brevity.
- sixhobbits 10y ago

michaelmior 10y ago

If it's open source, how can you hope you achieve security through obscurity?

sixhobbits 10y ago
evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they start trying to crack the more difficult ones. GPUs come out and some fancy machine learning. Then they do some specialised stuff, like implementing the LessPass open source function to start trying to crack LessPass specific passwords. This is now as difficult to crack as your master password for LessPass, but it's "security through obscurity" because they have to guess that you use LessPass, and will probably only start attacking your password once all the low-hanging fruit is gone, giving you more time to change your password/ delete your affected account, etc.
- stinkytaco 10y ago
  As someone pointed out above, the problem with this argument is that the password becomes cipher text. That means that each time it is gathered by an attacker it gets easier to compromise. For most of us, this is not an issue because there is so much low hanging fruit. For some -- say a celebrity or person of public interest -- this could be a serious problem as they are already the target of a focused effort.
  - whyever 10y ago
    > That means that each time it is gathered by an attacker it gets easier to compromise. I don't think this is relevant. You still need to inverse the key-derivation function. If you know a hundred passwords, this will be technically easier than if you know one password, but it should not matter if the security margin of the key-derivation function is high enough.

rco8786 10y ago

Agree with thought on implementation, but at least on mobile the. It about how it actually works is right below the first few marketing blurbs. Not that egregious.

gtrubetskoy 10y ago

I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password"): http://grisha.org/blog/2013/05/31/simple-solution-to-password-reuse/ http://grisha.org/blog/2013/05/31/simple-solution-to-passwor...

sixhobbits 10y ago
Considering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)
- gtrubetskoy 10y ago
  Lol - that's what happens when posting on a Monday before finishing the morning coffee. Someone commented on my article then that you can pretty much accomplish this from the command line with: > echo "masterpassword gmail" | md5 (Ignoring the implication of the password potentially getting logged in shell history, of course.)
  - austinjp 10y ago
    Maybe try just > md5sum | cut -d" " -f1 or similar. Carriage-return followed by ctrl-D to exit. Output matches echo "whatever" | md5sum | cut -d" " -f1 in my term.
palant 10y ago
You better add a huge "do not use" warning to that blog post. Deriving passwords via SHA-512 or similar is a very common mistake and makes guessing your master password way too easy. I outlined the details in my blog post here: https://palant.de/2016/04/20/security-considerations-for-password-generators https://palant.de/2016/04/20/security-considerations-for-pas... No, LessPass uses PBKDF2 which is already a lot better than merely SHA-512. However, with 8192 iterations it still makes guessing the master password too easy.

TuringTest 10y ago

Obviously you are not the target audience for the main website; it explains how it works in general terms, i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective. I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how to use it properly. You probably should jump directly to the github project page[1], where you'll find that kind of technical description that you were expecting and didn't find. [1] https://github.com/lesspass/lesspass https://github.com/lesspass/lesspass

appleflaxen 10y ago
respectfully disagree. "how it works" should show you the internals "what it does" is better description if you are just going to tell me the inputs and outputs.
- TuringTest 10y ago
  But the page does show you the internals of what it does, it's just that it's done in a very high level, enough for the non-technical people who will most benefit from that page: "The trick is to compute passwords rather than generate and store random passwords. LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know." "It does not save your passwords in a database. It does not need to sync your devices together. " "The system uses a pure function, i.e. a function that given the same parameters will always give the same result. In our case, given a login, a master password, a site and options it will returns a unique password." Etc.
  - bitJericho 10y ago
    I'm a technical person, and I thought this was a great and fast explanation to tell me what was going on. I don't need any more details than this and appreciated the brevity.
sixhobbits 10y ago