3 ms·

> (no 2FA) What do you mean? Does this tool prevent you from setting up 2FA on a service? > and less convenient (changing a master password is a pain) Changi

> (no 2FA) What do you mean? Does this tool prevent you from setting up 2FA on a service? > and less convenient (changing a master password is a pain) Changing passwords on many servieces is always as pain. But why should you change the masterpassword? > than a password manager is getting so much attention (2000+ stars on Github, WTF!?). Because it's pracmatic and secure enough. It's not secure enough if you are aome high value-target, but surprise, most people are just casual, which random malware and hackers being the worst level of attackers. Against thse this is plentiful, and better than what people use otherwise. You don';t need to strive for perfection, when a 90%-solution works fast enough.

paulryanrogers 7y ago
> Changing passwords on many servieces is always as pain. But why should you change the masterpassword? Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords. If a traditional master password is exposed its database/file may not have been. In that case only the master secret needs to change. Edit: correction: seed not derived.
- ravenstine 7y ago
  > and change all past account passwords. I don't understand this. In what case would there ever be "past" account passwords that I would have to change?
  - _pmf_ 7y ago
    You wouldn't have to change them, but you'd have to remember the master password for the last "generations" to be able to access the older accounts.
    - slightwinder 7y ago
      Seems it's prepared for this: "Change generated password without changing your master password. Increment the counter field in your options."
- slightwinder 7y ago
  > Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords. Uhm, no? There seems to be no direct relation between each passwords. So an attacker does not know by default that there is a masterpassword or what it is. For the real word there is no compromising if just login-data are randomly leaked. A high level attacker who get's to know your used system could use it probably as an attack-vector, but again, that's not what normal people prepare for.
- prophesi 7y ago
  It seems like Lesspass would be encouraging best practices in that case; if you believe your seed password has been compromised, then you _should_ change all of your passwords. On a similar note, I also think it's bad security hygiene to have accounts on hundreds of services in the first place, if changing all of your passwords is an insurmountable task. Might I suggest deleting a few accounts a day for lent?
igammarays 7y ago
> What do you mean? Does this tool prevent you from setting up 2FA on a service? No I mean the password manager itself has no 2FA. It is impossible to implement 2FA on this kind of password manager. Almost all password managers like 1Password, Bitwarden, etc. implement 2FA so even if your master password is compromised (e.g. by a remote keylogger), an attacker can't get into your vault without physical access to one of your existing devices.
- dependenttypes 7y ago
  > It is impossible to implement 2FA on this kind of password manager What makes you think that?

paulryanrogers 7y ago

> Changing passwords on many servieces is always as pain. But why should you change the masterpassword? Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords. If a traditional master password is exposed its database/file may not have been. In that case only the master secret needs to change. Edit: correction: seed not derived.

ravenstine 7y ago
> and change all past account passwords. I don't understand this. In what case would there ever be "past" account passwords that I would have to change?
- _pmf_ 7y ago
  You wouldn't have to change them, but you'd have to remember the master password for the last "generations" to be able to access the older accounts.
  - slightwinder 7y ago
    Seems it's prepared for this: "Change generated password without changing your master password. Increment the counter field in your options."
slightwinder 7y ago
> Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords. Uhm, no? There seems to be no direct relation between each passwords. So an attacker does not know by default that there is a masterpassword or what it is. For the real word there is no compromising if just login-data are randomly leaked. A high level attacker who get's to know your used system could use it probably as an attack-vector, but again, that's not what normal people prepare for.
prophesi 7y ago
It seems like Lesspass would be encouraging best practices in that case; if you believe your seed password has been compromised, then you _should_ change all of your passwords. On a similar note, I also think it's bad security hygiene to have accounts on hundreds of services in the first place, if changing all of your passwords is an insurmountable task. Might I suggest deleting a few accounts a day for lent?

igammarays 7y ago

> What do you mean? Does this tool prevent you from setting up 2FA on a service? No I mean the password manager itself has no 2FA. It is impossible to implement 2FA on this kind of password manager. Almost all password managers like 1Password, Bitwarden, etc. implement 2FA so even if your master password is compromised (e.g. by a remote keylogger), an attacker can't get into your vault without physical access to one of your existing devices.

dependenttypes 7y ago
> It is impossible to implement 2FA on this kind of password manager What makes you think that?