Lesspass: "The horror of LessPass"

The interview went to says:

Your goal is to make your password as random as possible, so anything that reduces randomness or entropy is going to reduce the effectiveness of your password

Is going to increase its bruteforceability

The Horror of LessPass - TWiT Netcast Network

Understanding our mistakes

We use patterns to create passwords with complex rules like _no consecutive vowels_ or _can't start with a number_.

We made two mistakes:

• First, we did not understand at the beginning that the entropy of the generated password increase the bruteforceability of the master password. I took the idea of password templates from masterpassword algorithm. We misunderstood and took for granted what we read.
• Then, it was to define cvCVns as template by default (consonms, vowels, etc.) instead of a more random one as x (full characters set).

On Open Source

And for anyone who thinks they do well at first, or who think that Open Source does not help. On the contrary, we believe that nobody does well at first, and thanks to the community scrutinity and critical studies of the code, this kind of tool becomes more robust the longer it lives.

How It Feels

The video is obviously a setbacks for us, especially after the euphoric past week where we went from ~100 to 1600+ stars, but we are glad that people review our code in depth and this came up early on.

Actions

We will use the full alphabet in the next version by default. We will probably increase the default length of generated passwords.

So in the future, we will describe (with drawings) the future algorithm and its implementation. We will simplify the code to helps everyone understand how it works. And we hope you will keep your eyes peeled for mistakes and stay critical to the code.

Best :heart: