News for hackers. Stuff that matters.
Re:Lesspass – open-source stateless password manager by baobabKoodaa on Sunday March 15, 2020 @06:38AM (#22582652)
If part of the seed has sufficient entropy, it doesn't matter if the attacker knows (or can guess) another part of the seed. Assuming the software uses a decent cryptographic hash function properly.
Re:Lesspass – open-source stateless password manager by Laforet on Sunday March 15, 2020 @11:11AM (#22583866)
This is true, however I can't help but feel that the design of the system encourages users to choose a low entropy master password and get a false sense of security seeing a different "strong" password can be produced for every account. The fact that the master password has to be typed frequently to recover the derived passwords adds to the problem.

This is the exact same problem with brain wallets, for which people delude themselves into thinking that they have managed to conjure a secret phrase that only they will know, only to get hacked in no time because the passphrase they came up with was just bad and they could not tell.

Re:Lesspass – open-source stateless password manager by baobabKoodaa on Sunday March 15, 2020 @07:17PM (#22587800)
I agree with you.