what's the difference between this project and lesspass?

[bboydflo]

I'm wondering if you've seen this project https://lesspass.com/#/ and what's the difference between the two.

[palant]

Yes, I've seen this project. While it now added a rudimentary Chrome extension (not sure whether the mobile apps have more functionality) and the approach is similar, I see some security concerns here:

• It seems that this extension doesn't have AutoFill functionality as such. It merely suggests passwords for a site and it's up to you to fill them in. Yet, from my list on https://palant.de/2018/08/29/password-managers-please-make-sure-autofill-is-secure this extension is failing to implement 1 and 4 properly.
• There is a tiny hint on the webpage saying "For more security use browser extensions." Did you notice it? Most people would probably be using that form without realizing that it cannot be trusted. Not making that hint more prominent is irresponsible.
• The key derivation scheme is PBKDF2 (to be exact: PBKDF2-HMAC-SHA256 with 100k iterations). That corresponds pretty much to the old PfP password generation scheme, but we now switched to scrypt which offers considerably more resistance towards bruteforce attacks.

Other than that, a whole lot of functionality seems to be missing that's available in PfP. As I already mentioned, no real AutoFill. From the look of it, no stored passwords either, only generated ones. No sync or backups.