Hacker News new | ask | show | jobs
by palant 3511 days ago
For reference, I am the author of the Easy Passwords extension which uses a similar concept.

5. The user-specific part is the user name. As long as these two users don't use the same user names they won't have the same passwords.

6. Password generators typically solve this by implementing a revision counter that you can increase in order to generate a new password. LessPass has this functionality, can be seen in screenshots.

7. What is served over the web? LessPass is a browser extension, the page you see in screenshots is contained in the extension.

I obviously disagree with your conclusion. Password generators are a very nice tool, and LessPass isn't currently using the full potential of the idea. For example, Easy Passwords allows you to create a "paper backup" of your passwords - all the password metadata (website, user name, password length) is safe to be printed, yet as long as you remember your master password it is sufficient to recreate your passwords. Of course, occasionally you simply cannot change a password which is why Easy Passwords has a hybrid concept and allows storing some passwords in encrypted form (no paper backup there).

1 comments

Thanks for adding some clarity here. Apparently I missed some of the finer details.

> What is served over the web?

There is a form for generating passwords right on the front page and it states nowhere that the browser extensions are the more secure / recommended way of using the tool.

Ah, I see. Yes, I have a similar one for Easy Passwords under https://palant.github.io/easypasswords/online.html - but it has a huge warning on it. This is not secure indeed and the recommended way of using that page if you absolutely have to is downloading it to your hard drive.