Re:Lesspass – open-source stateless password manager
by lewiscollard on Sunday March 15, 2020 @10:58AM
(#22583792)
You make some reasonable points, but two I find somewhat strange:
> Setting the master password to something insecure will undermine the security of all derived passwords
Then don't do that. The question is: Is LessPass in practice more likely to encourage this kind of poor security than its alternatives?
> Master key is related to the generated passwords. Using a strong PBKDF this should not be a problem, but why take the risk?
If its PBKDF is broken then so is its security. If crypto is incorrectly implemented in any other password manager then it too is broken. If the crypto algorithms used by TLS are broken then our online banking is broken. We don't avoid other things that rely on crypto just in case they might get broken some day.
[Mods: accidentally posted this as a top-level reply rather than a reply to this comment, sorry!]
> Setting the master password to something insecure will undermine the security of all derived passwords
Then don't do that. The question is: Is LessPass in practice more likely to encourage this kind of poor security than its alternatives?
> Master key is related to the generated passwords. Using a strong PBKDF this should not be a problem, but why take the risk?
If its PBKDF is broken then so is its security. If crypto is incorrectly implemented in any other password manager then it too is broken. If the crypto algorithms used by TLS are broken then our online banking is broken. We don't avoid other things that rely on crypto just in case they might get broken some day.
[Mods: accidentally posted this as a top-level reply rather than a reply to this comment, sorry!]