News for hackers. Stuff that matters.

A comment on Lesspass – open-source stateless password manager. Parent comment

Re:Lesspass – open-source stateless password manager by zimbatm on Sunday March 15, 2020 @06:02AM (#22582496)
- LessPass is a webpage that can be changed at any time and collect website, username and password triplets.

This is quite a big issue because it can be used for targeted attacks. There is no way of detecting compromises without reading the source on every page load.

[ Parent | on HN ]
Re:Lesspass – open-source stateless password manager by bad_user on Sunday March 15, 2020 @08:35AM (#22583111)
In all fairness, it's trivial to host it yourself.
[ Parent | on HN ]
Re:Lesspass – open-source stateless password manager by op00to on Sunday March 15, 2020 @06:15AM (#22582544)
There is no way you can tell if there’s an undetectable worm in your system.
[ Parent | on HN ]
Re:Lesspass – open-source stateless password manager by baobabKoodaa on Sunday March 15, 2020 @07:00AM (#22582727)
Those things are in no way comparable.

First of all, this is not a transfer of trust from A to B: in both cases (traditional password manager or this thing) you still need to trust that your own device is not compromised. But with this thing, you _also_ need to trust that the website is not compromised.

Secondly, the website is a much juicier attack target than your personal computer.

[ Parent | on HN ]