No screenshots?
Agreed. I would appreciate if a demo account was provided so you could check it out without signing up to the third-party database service.
Show HN: Passwords Fountain – password manager interface as a PWA
21–27 of 27 posts
Re: Show HN: Passwords Fountain – password manager interface as a PWA
#22It's awesome that you're making this. Reading your readme, I had some questions:
1. Are your passwords encrypted whenever the bits aren't on your physical device?
2. Are you using asymmetric cryptography to make sure only you hold the key to actually decrypt the passwords?
3. What forms of MFA do you support for authentication in order to open your vault/decrypt your passwords?
4. Where are you storing the decryption key?
Re: Show HN: Passwords Fountain – password manager interface as a PWA
#23It's awesome that you're making this. Reading your readme, I had some questions: 1. Are your passwords encrypted whenever the bits aren't on your physical device? 2. Are you using asymmetric cryptography to make sure only you hold the key to actually decrypt the passwords? 3. What forms of MFA do you support for authentication in order to open your vault/decrypt your passwords? 4. Where are you storing the decryption…
Great questions! I'll do my best to answer them:
1. You can decrypt only one password at once. It's stored in memory then. Rest of passwords remain encrypted and they are also stored in memory after being downloaded. It means that after webpage / PWA is being refreshed (or closed) you have no passwords (in any form) in the memory.
2. Passwords Fountain is using famously safe symmetric algorithm (AES-256). I think it would be hard use asymmetric approach in current architecture with staying user friendly in any way. Please note that there is no server between this app (interface) and Fauna (database) and I'm strongly against storing something needed to password decryption both in database (e.g. private key) and the browser. Becuase of that - you have to remember and protect your master key. Remember that you also have your dashboard after logging into FaunaDB account. You can verify database connections anytime you want.
3. MFA is quite serious feature and this would need also server code which I wanted to avoid as much as possible - it's making creating custom instance harder. Also - I suppose, I would have to force users to use an additional app for this purpose e.g. Google Authenticator (because I don't want to pay for any SMS service), which would make the regular usage strongly inconvenient.
4. Decryption key is stored in local variable (in memory) only for the moment it's really needed (from the moment after getting it from the user to putting it into decryption / encryption function). After this tiny time frame that aforementioned variable is getting back to its default value which is an empty string.
I hope you have now better understanding of how it works. If not - don't hesitate to ask additional questions ;)
Re: Show HN: Passwords Fountain – password manager interface as a PWA
#24> We don't store any vulnerable data - your passwords neither land on localStorage, sessionStorage, IndexedDB nor any server. > In your database ( https://fauna.com/ ) passwords are stored in encrypted version so nobody can steal them from there. So fauna is not a server and not something running local in the browser from my reading of the above. Looking at fauna.com it seems like it absolutely runs on servers, just…
Yes, I meant here any other servers but Fauna.
I thought it'll be obvious from the context, but I'll think about rephrasing this part. Thanks! :)
Re: Show HN: Passwords Fountain – password manager interface as a PWA
#25No screenshots?
Agreed. I would appreciate if a demo account was provided so you could check it out without signing up to the third-party database service.
There is link to Figma designs in the README. You can check there how it works without creating Fauna account, whole application flow is presented there ;)
Re: Show HN: Passwords Fountain – password manager interface as a PWA
#26I think a big reason why password managers tend to have native apps is so that the OS can better integrate with them. For example, iOS' `AuthenticationServices` API which can autofill username & passwords from a third party password manager. I don't think PWAs can achieve this yet. Personally I use Bitwarden, which offers both native and web client for all of my devices. In any case, still very good to see more choic…
Do you use Bitwarden on iOS/iPadOS? How do you get it to auto fill anything? It's quite cumbersome changing Windows back and forth just to copy-paste some fields.
Re: Show HN: Passwords Fountain – password manager interface as a PWA
#27I think a big reason why password managers tend to have native apps is so that the OS can better integrate with them. For example, iOS' `AuthenticationServices` API which can autofill username & passwords from a third party password manager. I don't think PWAs can achieve this yet. Personally I use Bitwarden, which offers both native and web client for all of my devices. In any case, still very good to see more choic…
Do you use Bitwarden on iOS/iPadOS? How do you get it to auto fill anything? It's quite cumbersome changing Windows back and forth just to copy-paste some fields.
Settings > Passwords & Accounts > Autofill Passwords
Select BitWarden
—-
Or, in apps with a share button like Safari, Share > BitWarden > Select Account > Boom