> Changing passwords on many servieces is always as pain. But why should you change the masterpassword?
Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords.
If a traditional master password is exposed its database/file may not have been. In that case only the master secret needs to change.
> Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords.
Uhm, no? There seems to be no direct relation between each passwords. So an attacker does not know by default that there is a masterpassword or what it is. For the real word there is no compromising if just login-data are randomly leaked.
A high level attacker who get's to know your used system could use it probably as an attack-vector, but again, that's not what normal people prepare for.
It seems like Lesspass would be encouraging best practices in that case; if you believe your seed password has been compromised, then you _should_ change all of your passwords.
On a similar note, I also think it's bad security hygiene to have accounts on hundreds of services in the first place, if changing all of your passwords is an insurmountable task. Might I suggest deleting a few accounts a day for lent?
Because when a seed password is compromised it could mean all future accounts are compromised. So then you have to increment or supplement with some state, and change all past account passwords.
If a traditional master password is exposed its database/file may not have been. In that case only the master secret needs to change.
Edit: correction: seed not derived.