LessPass: sync-less open source password manager
While the idea sounds alright (and I&#x27;ve seen similar ideas done before), there are a few problems with this system that make me quite cautious about trying it:<p>* In order to handle different password complexities, regeneration of passwords and similar setting, you have to use a &quot;connected&quot; version (read: you have to store the configuration). In addition, the configuration they have includes potentially sensitive information (password length, number of times password was changed, list of websites I use, <i>my username on the site</i>). And currently those profiles are unencrypted. So you in order for it to be useful it&#x27;s no longer sync-less. As an aside, my bank (foolishly) uses my generated username as a &quot;privileged&quot; piece of information -- which means that I literally could not use this manager for my bank.<p>* You can&#x27;t change your master password without updating all of your site passwords. This also means you can&#x27;t import your old passwords without just changing them all. IMO this makes LessPass not a password &quot;manager&quot;. It&#x27;s a password generator.<p>* Also, the profile doesn&#x27;t appear to contain any configuration details for the PBKDF, which seems like a bad idea (it means that they can never practically update the PBKDF without introducing backwards compatibility in the profile settings). Also not sure why they&#x27;re using SHA when there are better password hashing algorithms.<p>* Aliases are impossible to implement (without adding more information to the profile), which just makes this impossible to use with SSO systems (I&#x27;m not going to remember which of the 5 different hostnames I used to generate a password I use once a year).<p>I&#x27;ve got to admit that I kinda like the symbols shown next to your password to make sure you&#x27;re using the right master password, but there doesn&#x27;t seem to be any description how that&#x27;s generated. My guess is that it&#x27;s similar to SSH keyart (which then brings up the question how often will collisions happen with only X^3 options, and can you have two passwords result in different orderings of the same tokens).<p>Overall, seems like an okay idea. But I would prefer if someone just offered a nice way to host your KeePass databases (or rather if there was an app that did it). You could probably do it with git and push to GitLab or something, but that is just ugly to do manually.