16 ms·

I honestly am baffled how such a bad idea which is objectively less secure (no 2FA) and less convenient (changing a master password is a pain) than a password

• deleted 7y ago
  [deleted]
• Laforet 7y ago
  Cryptography is hard, opsec much harder. I frowned immediately when I realised that it generates deterministic password from seeds partially known to the attacker. This is only slightly better than the brain wallet concept for personal key management and back then people thought it was a good idea too. So I guess this kind of attempts will never go away.
  • minitech 7y ago
    > from seeds partially known to the attacker That’s heavily misleading, like complaining encryption is performed using a key partially known to the attacker because a nonce/IV is involved. The site name and username are there to derive different keys, not provide security.
    • Laforet 7y ago
      Except in this case there are no IV or nonce involved and every key derivation is perfectly replayable. Let's pause for a second and think what is the point of using password managers - I take it as a means to allow each account to have unique passwords that the leak of any of them won't lead to more account breaches. The method being shown here does nothing in this aspect as every password is effectively the same master password hashed with a known salt. One might argue that a costly derivation path could make bruteforcing impractical but it doesn't help with the fact that the concept is unsound from the beginning.
      • minitech 7y ago
        A strong master password is what makes brute-forcing impractical.
  • baobabKoodaa 7y ago
    If part of the seed has sufficient entropy, it doesn't matter if the attacker knows (or can guess) another part of the seed. Assuming the software uses a decent cryptographic hash function properly.
    • Laforet 7y ago
      This is true, however I can't help but feel that the design of the system encourages users to choose a low entropy master password and get a false sense of security seeing a different "strong" password can be produced for every account. The fact that the master password has to be typed frequently to recover the derived passwords adds to the problem. This is the exact same problem with brain wallets, for which people delude themselves into thinking that they have managed to conjure a secret phrase that only they will know, only to get hacked in no time because the passphrase they came up with was just bad and they could not tell.
      • baobabKoodaa 7y ago
        I agree with you.
• bsza 7y ago
  I think online password managers are a bad enough idea already. You should never send your password to anyone (except to the service you're using of course). Not even in encrypted form, since encryption is a reversible process.
  • pvg 7y ago
    By that logic, you shouldn't rely on encrypted communication at all since encryption is a reversible process.
    • bsza 7y ago
      Encrypted communication relies on keys generated by computers. They have significantly more bits of entropy than a master password produced by a human.
      • zokier 7y ago
        Master passwords should also be generated by computers (or dice if you want to go that route)
      • prophesi 7y ago
        The major problem with passwords is reuse. Nobody's out there trying to bruteforce your passwords, unless you're a state-level threat. In reality, they'll be using your password from a database leak from a different service and programmatically try a few variants of it before moving on to the next target. For physical access (like logging into a PC w/ SSH disabled), you only need 4 words to have sufficient entropy. Use 7 words if you want to reach a level of entropy that would literally cost decades of computing power to bruteforce. That said, the 7 word passphrase should be generated by a computer anyways. Also wanted to point out that the phrase "encryption is a reversible process" is hilarious. Encryption is literally about making it _as difficult as possible_ to reverse its process. Bruteforcing is not reversing the process.
        • bsza 7y ago
• Dinux 7y ago
  We've seen many of these tools and they are all flawed in the same way. - Setting the master password to something insecure will undermine the security of all derived passwords. The same thing can be said for traditional password managers but they at least do not correlate the master password to all other service passwords. - Master key is related to the generated passwords. Using a strong PBKDF this should not be a problem, but why take the risk? - Leaked passwords cannot be changed. - There are enough services which generate you a password and then only later lets you change it. - Cannot store PIN, ID, CVV, files etc.
  • anfilt 7y ago
    If you choose a strong master key this should still be secure even if a site leaks a generated sub-key/password. All you need to do is change the sub-key for that site. Both this and password managers though still can be hosed if the machine your using is compromised. Otherwise it should be secure as your master key. Leaked passwords can be changed for this they have what looks like a version input. If the master key can be reversed from a cryptographic hash function either the hash function has been broken or you chose a really bad master key. Although storing PINs and all the other random things some sites may use is a valid point. I am not sure I would call this less secure than a traditional password manager though.
  • zimbatm 7y ago
    - LessPass is a webpage that can be changed at any time and collect website, username and password triplets. This is quite a big issue because it can be used for targeted attacks. There is no way of detecting compromises without reading the source on every page load.
    • op00to 7y ago
      There is no way you can tell if there’s an undetectable worm in your system.
      • baobabKoodaa 7y ago
        Those things are in no way comparable. First of all, this is not a transfer of trust from A to B: in both cases (traditional password manager or this thing) you still need to trust that your own device is not compromised. But with this thing, you _also_ need to trust that the website is not compromised. Secondly, the website is a much juicier attack target than your personal computer.
• windor 7y ago
  Because it solves real problems (it's very easy to use, and I use a lot). It works similar with HD wallet in bitcoin or ethereum. In HD wallet, you can derive accounts for many crypto currencies from one seed password which is what master password in lesspass does. The counters in lesspass, can be used to derive another password for the same website, if one want to change the password for the website. HD wallet also has the similar functionality. If you want to change the bitcoin address, just derive another account from the seed password. And the solution to keep the seed password of HD wallet safe can also work with lesspass. such as [OpenSK][1]. [1]:https://github.com/google/OpenSK https://github.com/google/OpenSK
• MrManatee 7y ago
  I agree that it's worse, but I'm not that surprised about the attention. I've seen people come up with this idea in multiple threads about password managers, so there is clearly something appealing about it. Instead of seeing the traditional "stateful" model of password managers as additional strengthening (like I see it), some people see it as a weakness that we should get rid of. I don't understand why. Under what threat model does it make anything better? I use a traditional password manager. If an attacker, perhaps with a hidden camera, managed to see me type my master password, then they would still need access to one of my devices before they can use it. And if I had any idea that my master password might be compromised, I would change it just in case. It's quick and easy. With deterministically generated passwords, all of my passwords would be compromised the moment my master password is compromised. I might not even _have_ a complete list of all the passwords that I should now remember to change. And I wouldn't do it lightly, because it's far from quick and easy. Also, if a single generated password leaks, then an attacker could use that to start brute-forcing my master password. It's nice and all that there is PBKDF2 to slow it down, but the situation is still worse than with a traditional password manager, where one leaked password doesn't reveal any information about the other passwords.
• SloopJon 7y ago
  As someone who looked seriously at a scheme like this before reluctantly using a password manager instead, part of the appeal comes from vault anxiety. If I don't have the vault and a tool to use it, I can't access my accounts. I like the idea of a scheme that I can use with a preferred utility, but which I could assemble from commonly available tools if necessary. It's not too hard to find PBKDF2 in a Python or JavaScript library, or reimplement it yourself using even more commonly available primitives. To be clear, I was never under the illusion that a password generator is as secure as a vault full of random passwords. The point is to improve on password reuse, or trivial transformations on a core password. If you generate random passwords for every single account, this is not for you, but it's probably better than storing weak passwords in a vault. The problem, even if you ignore the straw men that usually get pummeled on threads like this, is that as you address the practical and security limitations of a naive scheme, you tend to lose the simplicity of the initial idea. You end up adding counters and password rules, so you have state to maintain/sync. Even if you don't treat it as secret, it chips away at the essential appeal of the concept. One comment on this post even mentions using a key file.
• slightwinder 7y ago
  > (no 2FA) What do you mean? Does this tool prevent you from setting up 2FA on a service? > and less convenient (changing a master password is a pain) Changing passwords on many servieces is always as pain. But why should you change the masterpassword? > than a password manager is getting so much attention (2000+ stars on Github, WTF!?). Because it's pracmatic and secure enough. It's not secure enough if you are aome high value-target, but surprise, most people are just casual, which random malware and hackers being the worst level of attackers. Against thse this is plentiful, and better than what people use otherwise. You don';t need to strive for perfection, when a 90%-solution works fast enough.
  • paulryanrogers 7y ago
    > Changing passwords on many servieces is always as pain. But why should you change the masterpassword? Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords. If a traditional master password is exposed its database/file may not have been. In that case only the master secret needs to change. Edit: correction: seed not derived.
    • ravenstine 7y ago
      > and change all past account passwords. I don't understand this. In what case would there ever be "past" account passwords that I would have to change?
      • _pmf_ 7y ago
        You wouldn't have to change them, but you'd have to remember the master password for the last "generations" to be able to access the older accounts.
        • slightwinder 7y ago
          Seems it's prepared for this: "Change generated password without changing your master password. Increment the counter field in your options."