3 ms·

Came here to say this. Why? What defect of password managers can you possibly be fixing by adding a global trustless append-only ledger to it?

woodaroo 8y ago
Instead of trusting a third party to protect your credentials, you're trusting an auditable, open source platform. I cant see myself using it for anything important, but I understand the draw.
- detaro 8y ago
  Any password manager that does the encryption stuff in offline, open-source software and puts it on any untrusted storage provides that, with the difference that it does not require making your encrypted copy public for all eternity, exposing it to unnecessary risk of compromise down the road.
  - woodaroo 8y ago
    There are risks either way. There have been plenty of vulnerabilities in popular password managers (some that also apply to this blockchain model). But I think your AES encrypted password being publically visible is a pretty low risk, compared to a PW manager being breached, having a flaw in the client, their being coerced by government, etc
    - the_snooze 8y ago
      How is this project any less at risk for those client-side implementation risks you mention? Basically, why should this nascent project be trusted over, say, KeePass?
zwevgzewgzv 8y ago
Many password managers require you to have an account online, to store the password vault. Passwords don't take up much space, so instead of uploading your encrypted password vault to google drive or some other service, where google might decide to lock you out or stop maintaining the service, you can put it on the ledger. When you need the passwords, assuming the chain functions normally, you can download the chain and your vault (that no one else can open, since they don't have your key). How confident are you that a typical company/project will be around in 20 years? How confident are you that the BTC ledger will be intact in 20 years? Either way, keep a local backup if you can.

woodaroo 8y ago

Instead of trusting a third party to protect your credentials, you're trusting an auditable, open source platform. I cant see myself using it for anything important, but I understand the draw.

detaro 8y ago
Any password manager that does the encryption stuff in offline, open-source software and puts it on any untrusted storage provides that, with the difference that it does not require making your encrypted copy public for all eternity, exposing it to unnecessary risk of compromise down the road.
- woodaroo 8y ago
  There are risks either way. There have been plenty of vulnerabilities in popular password managers (some that also apply to this blockchain model). But I think your AES encrypted password being publically visible is a pretty low risk, compared to a PW manager being breached, having a flaw in the client, their being coerced by government, etc
  - the_snooze 8y ago
    How is this project any less at risk for those client-side implementation risks you mention? Basically, why should this nascent project be trusted over, say, KeePass?

zwevgzewgzv 8y ago

Many password managers require you to have an account online, to store the password vault. Passwords don't take up much space, so instead of uploading your encrypted password vault to google drive or some other service, where google might decide to lock you out or stop maintaining the service, you can put it on the ledger. When you need the passwords, assuming the chain functions normally, you can download the chain and your vault (that no one else can open, since they don't have your key). How confident are you that a typical company/project will be around in 20 years? How confident are you that the BTC ledger will be intact in 20 years? Either way, keep a local backup if you can.