News for hackers. Stuff that matters.

A comment on New, portable, open source password manager for Windows.

Re:New, portable, open source password manager for Windows by gruez on Sunday May 05, 2019 @07:55PM (#19835832)
Why this over keepass?

Also, a quick skim of the source code shows that the program keeps the decrypted file on-disk[1]. That seems like a huge vulnerability if you don't have FDE enabled.

[1] https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...

https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...

[ Parent | on HN ]
Re:New, portable, open source password manager for Windows by regecks on Sunday May 05, 2019 @08:29PM (#19835976)
I think you need FDE no matter what. e.g. Hibernation will dump your passwords to disk, even if they're only kept in in unmanaged, VirtualProtect'ed memory.
[ Parent | on HN ]
Re:New, portable, open source password manager for Windows by jakobdabo on Monday May 06, 2019 @05:38PM (#19844169)
And they are doing MAC-then-Encrypt in 2019.

The author may be a great person and an excellent software developer, but they are an amateur in applied cryptography.

Use with caution.

[ Parent | on HN ]
Re:New, portable, open source password manager for Windows by akx on Monday May 06, 2019 @08:43AM (#19838858)
Yeah, that looks suspect. Maybe open a GitHub issue about it?
[ Parent | on HN ]