Live data from Hacker News

Show HN: Bramble – Local-first password manager

github.com

11–20 of 64 posts

Re: Show HN: Bramble – Local-first password manager

#11

You built your own sync engine? Why?

Most sync engines are targeted towards being fast. I suppose for a PM you'd want one that's very resource efficienct. I'm just spitballing here, I'm not OP

It's a hard feature to get right, it is complex and networking across the internet is unreliable. I am an advocate for local-first and P2P, but I would like to see contributions to existing libraries rather then weaker implementations

Re: Show HN: Bramble – Local-first password manager

#12
post #4

Earlier quoted context omitted.

Fair enough. I like staying pseudonymous on the internet, but I also understand where you're coming from. My name is Doug, based in Toronto, Canada. I've been a software engineer for over 10 years, working in various startups that handle very sensitive data (fintech, health tech, legal tech.) I've had the opportunity to build security-heavy software and directly handled sensitive info like SIN, bank details, patient…

How's support for credit card form entries? That's the one thing that makes me miss 1Password as a current keepass user and will make me move over.

It exists and is thoroughly tested for common cases, but there might be tricky form shapes that haven't been covered.

Give it a try and if you find anything, I'll prioritize fixing it. I'm really keen on getting a top-notch autofill engine.

Re: Show HN: Bramble – Local-first password manager

#13
post #9

Congrats! How’s it compare vs self-hosted vaultwarden?

Thanks!

Way less overhead than hosting your own vaultwarden instance, so way more user friendly with basically the same effect. The big difference is there's no server at all. With vaultwarden you're running a box that holds your whole vault and you have to keep it patched, backed up and secured (sysadmin skills basically). Bramble just syncs your devices directly so there's nothing to host or maintain = no single point of failure.

One tradeoff is both devices need to be online at the same time, since there's no server in the middle holding your changes for later. For me that's worth it and intentional.

Re: Show HN: Bramble – Local-first password manager

#15

You built your own sync engine? Why?

if you mean why I didn't choose a lib like automerge, yjs and instead handrolled it - that's because these libs are geared towards plaintext.

Bramble's sync is built around its own encrypted vault instead. When two devices conflict it just compares timestamps on the encrypted entries and keeps the newer one as-is, without ever unwrapping your per-entry keys to merge. Nothing off the shelf did that against my vault format, so the core is custom. It's a pretty simple implementation tbh

Re: Show HN: Bramble – Local-first password manager

#16

Really clean concept. Keeping everything entirely on-disk instead of relying on a third-party cloud is something I've been wanting to see more of.

Thank you! I'm a firm believer of this as well, especially with how things almost always turn out for venture backed companies. I feel like there's a push towards local-first and self-hosted solutions these days, and rightfully so.

Re: Show HN: Bramble – Local-first password manager

#17
post #8

I think local-first password managers are the way forward. Big tech companies already have way too much power and having them mediate our most important data is a bad precedent to set. I like that you made this P2P, I designed one that sits on top of sqlite and is 100% local first but is not P2P, take a look if you are interested in some prior art in this space: https://saveoursecrets.com/ I decided to go with native…

Thanks for sharing! And I fully agree with you. The convenience that cloud providers bring is hard to match sometimes, but the tools exist to make it happen.

I'll check out your website and see what's up!

Re: Show HN: Bramble – Local-first password manager

#20

When I hear P2P I imagine my data going through other people's devices - but it sounds like this is a private P2P network.

ah yes, I didn't even think of this! It's fully private and I'll update my copy to indicate that. Thank you!
Post reply on HN