back

by sixhobbits·9y ago·view on hn ↗
I really dislike the copy/marketing of this tool. OK, so it doesn't sync? How does it work? reads whole front page and all features. No sync, but access anywhere? How does it work?? *clicks the "How it works" link and reads another 5 paragraphs of "This is great. It's so simple. It works really really well. You can phone people and they'll tell you how well LessPass works". Finally, after clicking on the link and scrolling past a bullet list and stylised quotation, we get

"The trick is to compute passwords rather than generate and store random passwords.

LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know."

"Next-gen", "Anywhere, anytime", "Manage directly from your browser". These are all super cliched, really cheap phrases that I really dislike. The front page is full of them. If you're marketing a luxury yacht trip to people with more money than sense, then sure you're probably going to get good results by writing like this. But the folk reading about this are going to be pretty technical and I'm sure everyone would appreciate to see something like "We provide a function that generates a memorable password from the site name and your master password" on the front page, above the fold.

In terms of entropy, you may as well come up with your own function. Security through obscurity is bad (no one knows the function you use to generate site specific passwords) but it's better than security through less obscurity (use a public function that a bunch of other people are using).

You can't get free entropy. If you care about your passwords not being broken when a database of hashes is dumped, you need to use a long, securely generated, random password. Sure, this is better than using the same password everywhere, but it's not really an alternative to something that uses proven cryptography to generate secure unique passwords. Passwords generated using this are only as good as your master password, with some obscurity thrown in.

4 comments
Obviously you are not the target audience for the main website; it explains how it works in general terms, i.e. what concepts should I know to understand its purpose and usage; not how it works from a technical perspective.

I only wish more open source websites followed this same approach, as it is the best way to introduce the tool to a public that may not know very well what a password manager is good for or how to use it properly.

You probably should jump directly to the github project page[1], where you'll find that kind of technical description that you were expecting and didn't find.

[1] https://github.com/lesspass/lesspass

Well there are different levels of description here.

First, I think I am pretty representative of the target audience for the main website (it's sad, but most non technical people still don't know what a password manager is or why they might want to use one).

Second, there is a difference between "What it does" (A password manager that re-computes the same site-specific password on every use, meaning that no syncing of passwords is necessary) which you can still make pretty informative vs "Me telling you why you should use it" (The cliches I quoted). Even if the website was aimed at those with zero technical knowledge, it could still give more concrete detail on what it is and why you need it rather than the empty marketing phrases.

The github repo should be where I go if I want to know what hashing libraries they're using, if their Math checks out, and who the contributors are. Not if I just want to know what it actually is (apart from "The best ever super duper password manager that you really need to download right now before tomorrow") and kind-of-how it works.

> First, I think I am pretty representative of the target audience for the main website (it's sad, but most non technical people still don't know what a password manager is or why they might want to use one).

Maybe they're trying to make a website for non technical people, in order to gain some traction among that audience?

If developers keep pandering to the technical audience who already knows enough about the purpose of password lockers, you have a circular problem where the general audience never learns about them.

And remember, marketing phrases exist because they work. If you don't know what a product is good for, the seller needs to state it in plain terms in order to convince the customers of how it could benefit them.

Plain terms doesn't mean meanless terms. Having meaningless marketing buzzwords is not useful. You can explain things simply and clearly without resorting to vagueness.
respectfully disagree.

"how it works" should show you the internals

"what it does" is better description if you are just going to tell me the inputs and outputs.

But the page does show you the internals of what it does, it's just that it's done in a very high level, enough for the non-technical people who will most benefit from that page:

"The trick is to compute passwords rather than generate and store random passwords.

LessPass generates unique passwords for websites, email accounts, or anything else based on a master password and information you know."

"It does not save your passwords in a database. It does not need to sync your devices together. "

"The system uses a pure function, i.e. a function that given the same parameters will always give the same result. In our case, given a login, a master password, a site and options it will returns a unique password."

Etc.

I'm a technical person, and I thought this was a great and fast explanation to tell me what was going on. I don't need any more details than this and appreciated the brevity.
If it's open source, how can you hope you achieve security through obscurity?
evil hax0r has database of leaked hashes from shittyonlinewebappyoudidntknowyousignedupfor.com, which includes your email address and a bad hash of your password. They run them through some standard password dictionaries using hashcat and break all of the 'letmein', 'monkey', 'qwerty', '111111' passwords within seconds. Then they run some bigger dictionaries and some nice rule-sets and crack another 50%. Then they start trying to crack the more difficult ones. GPUs come out and some fancy machine learning. Then they do some specialised stuff, like implementing the LessPass open source function to start trying to crack LessPass specific passwords. This is now as difficult to crack as your master password for LessPass, but it's "security through obscurity" because they have to guess that you use LessPass, and will probably only start attacking your password once all the low-hanging fruit is gone, giving you more time to change your password/ delete your affected account, etc.
As someone pointed out above, the problem with this argument is that the password becomes cipher text. That means that each time it is gathered by an attacker it gets easier to compromise. For most of us, this is not an issue because there is so much low hanging fruit. For some -- say a celebrity or person of public interest -- this could be a serious problem as they are already the target of a focused effort.
> That means that each time it is gathered by an attacker it gets easier to compromise.

I don't think this is relevant. You still need to inverse the key-derivation function. If you know a hundred passwords, this will be technically easier than if you know one password, but it should not matter if the security margin of the key-derivation function is high enough.

Agree with thought on implementation, but at least on mobile the. It about how it actually works is right below the first few marketing blurbs. Not that egregious.
I don't have the time to figure out how it works, but I bet it uses the same principle that I presented about 3 years ago (basically there is a "master password"):

http://grisha.org/blog/2013/05/31/simple-solution-to-passwor...

You better add a huge "do not use" warning to that blog post. Deriving passwords via SHA-512 or similar is a very common mistake and makes guessing your master password way too easy. I outlined the details in my blog post here:

https://palant.de/2016/04/20/security-considerations-for-pas...

No, LessPass uses PBKDF2 which is already a lot better than merely SHA-512. However, with 8192 iterations it still makes guessing the master password too easy.

Considering the part I quoted literally includes the phrase "based on a master password", you could probably have taken the time to 'figure out how it works' ;)
Lol - that's what happens when posting on a Monday before finishing the morning coffee.

Someone commented on my article then that you can pretty much accomplish this from the command line with:

    > echo "masterpassword gmail" | md5
(Ignoring the implication of the password potentially getting logged in shell history, of course.)
Maybe try just

> md5sum | cut -d" " -f1

or similar. Carriage-return followed by ctrl-D to exit. Output matches echo "whatever" | md5sum | cut -d" " -f1 in my term.