Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Bramble – Local-first password manager

github.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Show HN: Bramble – Local-first password manager

#21

Post by catapart »

This looks like something I've been looking for! Excited to give it a try! I don't even use a password manager because of the things you've seemed to work around here. It's been painful.

Honestly, though, I'm most intrigued by your P2P solution. I've built a couple of web apps as custom html elements that use indexedDB for storage and I've been trying to figure out the sweet spot for syncing the data between apps. I think this nostr relay hits the mark as something people can feel comfortable not self hosting, while power users can host their own solution. Seems like a great solution, to me! Any advice as to some footguns with the approach? I'm very interested in giving it a try myself[0], so any notes you think would prevent some re-work would be really appreciated!

[0] as a public domain/oss-licensed module, if there's a reasonable method of packaging it as a standalone library

Re: Show HN: Bramble – Local-first password manager

#22

Post by jjnoakes »

MegagramEnjoyer wrote: post #15
keepupnow wrote: post #6

You built your own sync engine? Why?

if you mean why I didn't choose a lib like automerge, yjs and instead handrolled it - that's because these libs are geared towards plaintext. Bramble's sync is built around its own encrypted vault instead. When two devices conflict it just compares timestamps on the encrypted entries and keeps the newer one as-is, without ever unwrapping your per-entry keys to merge. Nothing off the shelf did that against my vault fo…

Last writer wins may be sufficient for some folks but for me, any potential data loss in an app like this is a deal breaker. I hope you'll consider some kind of merge conflict detection and surfacing that to the user. Even keeping a list of deleted items and showing that can be a good start.

Re: Show HN: Bramble – Local-first password manager

#23

Post by cicko »

MegagramEnjoyer wrote: post #15
keepupnow wrote: post #6

You built your own sync engine? Why?

if you mean why I didn't choose a lib like automerge, yjs and instead handrolled it - that's because these libs are geared towards plaintext. Bramble's sync is built around its own encrypted vault instead. When two devices conflict it just compares timestamps on the encrypted entries and keeps the newer one as-is, without ever unwrapping your per-entry keys to merge. Nothing off the shelf did that against my vault fo…

This deserves a bit more explanation (sorry, on the phone, can't look at the code in the next couple of days). So, if I change the password and update it on the phone, then add a web site on the desktop, when they sync, the desktop entry will overwrite the new password? Hope it's not that simple.

Re: Show HN: Bramble – Local-first password manager

#28

Post by tamimio »

It’s nice to always have more options but I don’t want it to be local, I lose the centralized system and having multiple devices syncing the pass database, or a turned off device, or an attack/ransom that took all your files including your passowrds, or your lost your device while traveling.. It’s better to have them secured somewhere safe and only accessible remotely, and there are plenty of self hosting options out there.
Post reply on HN