33
Review of LessPass? (lemmy.world)
submitted 11 months ago* (last edited 11 months ago) by MigratingtoLemmy@lemmy.world to c/selfhosted@lemmy.world

Hi everyone,

I just came across this project called LessPass, which doesn't require a database as a back-end and can compute passwords on the fly instead of storing them. The idea really intrigued me, and I wanted to know from the community about the experience of using it - did you run into any troubles with it? How does it compare to more traditional password managers (which would need me to think of a back-up strategy)?

Is it possible to back up your passwords from LessPass? Can you use your own passwords when you prefer to? How are the client programs?

Thanks!

you are viewing a single comment's thread
view the rest of the comments
[-] narc0tic_bird@lemm.ee 25 points 11 months ago

It's a cool concept that quickly falls apart in my opinion:

  1. It's not really stateless as soon as a website has certain password requirements. You probably don't want to remember the configuration of all passwords in your head.
  2. If the password for a website gets compromised, you have to set the "counter" + 1. Again, not stateless.
  3. If you have multiple accounts per website, you'll have to store the site differently (for example including www, not including www) or interlace the counter (odd/even) between the two. This gets more and more messy the more accounts you add, and again, it's not stateless.
  4. The master password is the only thing an attacker needs (plus the state mentioned above, but it's easy to brute force a simple counter). With most other password managers, the attacker needs access to the vault/database and potentially a keyfile, secret and/or some form of second factor.
  5. Changing your master password because it got compromised or ideally before it gets compromised changes the passwords for all websites.
  6. You still have to remember your username or login email, so that's again not stateless if you're saving it in some sort of LessPass client.

I could probably list a lot of other reasons why it's not a good idea to use it. There are probably some edge cases where it's good, for demonstration purposes or training sessions where the participants all need unique (temporary) logins for several services.

[-] ThetaDev@lemm.ee 4 points 11 months ago

You also cannot use it to store secret information like bank account/credit card details, API keys, etc.

[-] MigratingtoLemmy@lemmy.world 1 points 11 months ago

Thanks, I'll keep this in mind.

[-] ogarcia@lemmy.world 1 points 11 months ago

In my view, both a password file (vault/database) and LessPass are potentially attackable via brute force. I don't see that one is safer than the other.

[-] narc0tic_bird@lemm.ee 1 points 11 months ago

Point being that an attacker also needs access to said vault.

[-] jeffhykin@lemm.ee 1 points 11 months ago* (last edited 11 months ago)

#3 isn't true. There's a username field, so you just put in the username of the alt accounts.

Your point about the master password and two factor is a good one though.

In practice password restrictions are rare (like 1% of sites), but they are problematic when they happen because there's so many different ways to restrict passwords and trying all combinations is impractical. Needing the counter is exceedingly rare. Remembering the username isn't a problem, but if you don't have a consistent policy of always-using-a-username or always-using-the-email (as the lesspass username) it can be difficult to remember that. Similar situation with the URL, if it's not abbreviated consistently, then it's a problem.

That said, I still use LessPass for everything and just deal with the edgecase problems.

this post was submitted on 25 Nov 2023
33 points (88.4% liked)

Selfhosted

40134 readers
289 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS