4 ms·

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If yo

by guillaume20100 9y ago

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault. If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager. Disclaimer I am the creator of LessPass [1] https://lesspass.com/ https://lesspass.com/

arthulia 9y ago
This is pretty brilliant. My biggest concern is that if my password for a site gets compromised, it gets a lot more complicated. Presumably I'd have to memorize a separate master password for retrieving the new password for that site.
- prophesi 9y ago
  They have a counter option that you can increment which allows you to generate a completely different password for the same site.
  - arthulia 9y ago
    But then you have to remember the counter setting for that website. So it's almost the same problem; I could just add a 1 to the end of my master password for that website.
    - prophesi 9y ago
      No, the counter would be saved by LessPass. Every time you look up the password for that site, it'll already know what the counter is set to for that site. This blog post[0] shows how LessPass lets you change passwords per site, and get around tricky password requirements. [0] https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4 https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4
    - hansjorg 9y ago
      I've just installed it and haven't yet used it, but as far as I can tell from the docs, the counter is stored as part of the syncable profile for a site. The profile is also used to store other site-specific attributes, like if it has some weird password rule that requires pure alphanumeric or a specific password length.
  - eikenberry 9y ago
    But once you did that it wouldn't be stateless anymore as you'd need to connect to their server every time to check on the state of that site's password. This makes it not that much different from traditional online managers where you have to connect to the site to retrieve the password. There is still the benefit that the passwords can't be exposed by a compromise of the service. Presumably it doesn't store your master password anywhere, so all they'd get is the site and counter info.
    - prophesi 9y ago
      True. You'd have to connect to their server or your own self-hosted LessPass to get your saved profile.
    - rorosaurus 9y ago
      You also have the option save this profile db locally, or store it yourself manually in a txt file if you really care. That's also necessary if a certain site has password restrictions.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
redthrow 9y ago
Lesspass seems nice but how about keeping all passwords in a .txt file and password protecting that file? One benefit of the password-protect-text-file method over Lesspass is you can also save answers to so-called "security questions" (for those sites that still use them, like Paypal and government sites). Alternatively, one can use Schneier's write-down-password-on-a-small-piece-of-paper method. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...
- c13k 9y ago
  This method works very well. I have one large text file containing all my credentials, stored in a an encrypted VeraCrypt file. I have all this stored in my Linux box. I backup to my server side encrypted AWS S3 bucket protected with 2FA. No need for me to sync anything, but if I need access to my VeraCrypt file, I can download it when required. I've used this method for two decades now, first using OSX .dmg files, then TrueCrypt, now VeraCrypt. Simple, and works well.
  - rorosaurus 9y ago
    I suppose the main pain with this method would be accessing the passwords on other devices. For example, I'd prefer to be able to copy/paste password on my phone, instead of referring to another computer and typing it in one random character at a time.
ss64 9y ago
https://ss64.com/pass/ https://ss64.com/pass/ Is similar to LessPass but is entirely javascript in the browser, so you can save the page and run a local copy completely offline or upload to your own website. Theres also a command line version for both bash and PowerShell https://ss64.com/pass/command-line.html https://ss64.com/pass/command-line.html
nialv7 9y ago
I use KeePass and I only keep the database on my phone. When I need the database on my laptop, I use kdeconnect to share the file. Which basically uses sftp with a temporary key. There is no need to put anything on someone else's computer.
rorosaurus 9y ago
This appears to be very similar to MasterPassword. Do you have a minute to explain to me what advantages LessPass offers? [1] http://masterpasswordapp.com/ http://masterpasswordapp.com/
- tom4000 9y ago
  Not at all. While Masterpassword does not save any passwords but generates it based on some unique parameters live - pass stores passwords and notes encrypted with GPG in a git repository. The list differences to LastPass is long. Pass is OpenSource. Pass doesn't store your information on anybody else's computer by default. Pass has not first party browser plugin and is therefore not open to attack through browser plugin holes. On the other hand you control everything by yourself including batch updating your passwords. And there's no online service.
reledi 9y ago
Disclaimer: stateless/deterministic password managers have some serious flaws compared to stateful/vault password managers. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... for example

arthulia 9y ago

This is pretty brilliant. My biggest concern is that if my password for a site gets compromised, it gets a lot more complicated. Presumably I'd have to memorize a separate master password for retrieving the new password for that site.

prophesi 9y ago
They have a counter option that you can increment which allows you to generate a completely different password for the same site.
- arthulia 9y ago
  But then you have to remember the counter setting for that website. So it's almost the same problem; I could just add a 1 to the end of my master password for that website.
  - prophesi 9y ago
    No, the counter would be saved by LessPass. Every time you look up the password for that site, it'll already know what the counter is set to for that site. This blog post[0] shows how LessPass lets you change passwords per site, and get around tricky password requirements. [0] https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4 https://blog.lesspass.com/lesspass-how-it-works-dde742dd18a4
  - hansjorg 9y ago
    I've just installed it and haven't yet used it, but as far as I can tell from the docs, the counter is stored as part of the syncable profile for a site. The profile is also used to store other site-specific attributes, like if it has some weird password rule that requires pure alphanumeric or a specific password length.
- eikenberry 9y ago
  But once you did that it wouldn't be stateless anymore as you'd need to connect to their server every time to check on the state of that site's password. This makes it not that much different from traditional online managers where you have to connect to the site to retrieve the password. There is still the benefit that the passwords can't be exposed by a compromise of the service. Presumably it doesn't store your master password anywhere, so all they'd get is the site and counter info.
  - prophesi 9y ago
    True. You'd have to connect to their server or your own self-hosted LessPass to get your saved profile.
  - rorosaurus 9y ago
    You also have the option save this profile db locally, or store it yourself manually in a txt file if you really care. That's also necessary if a certain site has password restrictions.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

redthrow 9y ago

Lesspass seems nice but how about keeping all passwords in a .txt file and password protecting that file? One benefit of the password-protect-text-file method over Lesspass is you can also save answers to so-called "security questions" (for those sites that still use them, like Paypal and government sites). Alternatively, one can use Schneier's write-down-password-on-a-small-piece-of-paper method. https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...

c13k 9y ago
This method works very well. I have one large text file containing all my credentials, stored in a an encrypted VeraCrypt file. I have all this stored in my Linux box. I backup to my server side encrypted AWS S3 bucket protected with 2FA. No need for me to sync anything, but if I need access to my VeraCrypt file, I can download it when required. I've used this method for two decades now, first using OSX .dmg files, then TrueCrypt, now VeraCrypt. Simple, and works well.
- rorosaurus 9y ago
  I suppose the main pain with this method would be accessing the passwords on other devices. For example, I'd prefer to be able to copy/paste password on my phone, instead of referring to another computer and typing it in one random character at a time.

ss64 9y ago

https://ss64.com/pass/ https://ss64.com/pass/ Is similar to LessPass but is entirely javascript in the browser, so you can save the page and run a local copy completely offline or upload to your own website. Theres also a command line version for both bash and PowerShell https://ss64.com/pass/command-line.html https://ss64.com/pass/command-line.html

nialv7 9y ago

I use KeePass and I only keep the database on my phone. When I need the database on my laptop, I use kdeconnect to share the file. Which basically uses sftp with a temporary key. There is no need to put anything on someone else's computer.

rorosaurus 9y ago

This appears to be very similar to MasterPassword. Do you have a minute to explain to me what advantages LessPass offers? [1] http://masterpasswordapp.com/ http://masterpasswordapp.com/

tom4000 9y ago
Not at all. While Masterpassword does not save any passwords but generates it based on some unique parameters live - pass stores passwords and notes encrypted with GPG in a git repository. The list differences to LastPass is long. Pass is OpenSource. Pass doesn't store your information on anybody else's computer by default. Pass has not first party browser plugin and is therefore not open to attack through browser plugin holes. On the other hand you control everything by yourself including batch updating your passwords. And there's no online service.

reledi 9y ago

Disclaimer: stateless/deterministic password managers have some serious flaws compared to stateful/vault password managers. See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-password-managers https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... for example