The last time I looked at Lesspass, its implementation was worryingly incompetent[1][2]. Just use your browser’s password manager; it’s less phishable than a ma

The last time I looked at Lesspass, its implementation was worryingly incompetent[1][2]. Just use your browser’s password manager; it’s less phishable than a manual `genp site` and your passwords don’t pass through your clipboard. EDIT: I revisited the code. Looks like everything in [1] is fixed, nothing in [2] is fixed, there are now JWTs for some reason, and… they removed metadata encryption??[3][4] Or it was never in in the first place and simple-crypto-js was used for something else? Either way, it’s a current and major flaw. [1] https://news.ycombinator.com/item?id=22587940 https://news.ycombinator.com/item?id=22587940 [2] https://news.ycombinator.com/item?id=22582570 https://news.ycombinator.com/item?id=22582570 [3] https://github.com/lesspass/lesspass/issues/185 https://github.com/lesspass/lesspass/issues/185 [4] https://github.com/lesspass/lesspass/blob/314fc7386f2c29750c9b68c801a2c078706b2b82/containers/backend/api/models.py#L75-L76 https://github.com/lesspass/lesspass/blob/314fc7386f2c29750c...