Comment by pipes

2 days ago

Did you have any thoughts on password safe?

https://pwsafe.org/

I am really afraid of supply chain attack. It feels inevitible that this will happen.

my only thought is i should just roll my own personal password manager closed source.

3 comments

pipes

Reply
Aachen  2 days ago

I mean, you don't have to update if you think that's the most likely vector (I don't disagree, at least for managers that have no online components, not even an update check). I'd recommend reading the changelogs though to see if they upgraded encryption parameters or did other fixes that you should want. You could wait a while applying them, and/or spot check if the diff makes sense

Unless you want sync or other online functionality, you're almost certainly better off with an ancient version of some trusted password manager than with a custom implementation. And if you do, I'd still not necessarily recommend it, but then imo it depends on your experience/knowledge level (regardless of whether you use an LLM)

I've never heard of the one you mention so I can't say anything positive or negative about it. The page looks ancient enough that I... not immediately trust it blindly, but it speaks for it. They either care about stability (not jumping on the latest fashion trends) ...or it's abandoned and the last release might or might not be flawless :p

pwdisswordfishq  2 days ago

What supply-chain attack do you suspect pwsafe of being at risk of?

  • pipes  20 hours ago

    Nothing in particular. In my head all that needs to happen is some form of update (dependency, core project or the Android version on my phone) and sneaks in something that reads the unencrypted file and sends it over the internet somewhere.

    I wish android and windows had flat seal, as far as I can remember that can prevent all network access for a given app.