• 0 Posts
  • 15 Comments
Joined 1 year ago
cake
Cake day: June 18th, 2023

help-circle










  • It’s a cool concept that quickly falls apart in my opinion:

    1. It’s not really stateless as soon as a website has certain password requirements. You probably don’t want to remember the configuration of all passwords in your head.
    2. If the password for a website gets compromised, you have to set the “counter” + 1. Again, not stateless.
    3. If you have multiple accounts per website, you’ll have to store the site differently (for example including www, not including www) or interlace the counter (odd/even) between the two. This gets more and more messy the more accounts you add, and again, it’s not stateless.
    4. The master password is the only thing an attacker needs (plus the state mentioned above, but it’s easy to brute force a simple counter). With most other password managers, the attacker needs access to the vault/database and potentially a keyfile, secret and/or some form of second factor.
    5. Changing your master password because it got compromised or ideally before it gets compromised changes the passwords for all websites.
    6. You still have to remember your username or login email, so that’s again not stateless if you’re saving it in some sort of LessPass client.

    I could probably list a lot of other reasons why it’s not a good idea to use it. There are probably some edge cases where it’s good, for demonstration purposes or training sessions where the participants all need unique (temporary) logins for several services.