Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

OK, fine. This is one thing I can finally use.

(I can't use regular storage-based password managers, as I have ADD and I will lose my password file. If it is backed up, I will lose a backup, or I will forget to update it when passwords are changed, or something else. I always screw such things up, this is absolutely inevitable, so I have to prepare. To compensate, my symbolic memory is excellent, so I just chose to memorize all my passwords, as I can't lose my head. But even my memory has limits, and I had to lose some entropy on my passwords to keep them all in my head.)

Now, I will get the best of both worlds.



What's wrong with something like Lastpass?


Lastpass is something I have no control of. Leaks can happen (already have: https://blog.lastpass.com/2015/06/lastpass-security-notice.h...). More importantly, DDoS can happen, and I will be out of access to everything.


Lastpass stores your password encrypted. If in your threat model you're unwilling to use Lastpass because of the leakability of the master database, you should avoid Lesspass since trying to guess your password on Webstie X given Lastpass database is more/less the same as trying to guess it given you're using Lesspass.


Like I said before, leakability of master database is not that big concern. DDoS on Lastpass, however, is a very likely scenario, especially in the light of recent high-profile DDoS attacks.


DDoS on LastPass is not a big deal as long as you have at least one device logged on. LastPass database is stored locally and can be used off-line.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: