Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Sesame - a local-first, open-source password manager

usesesame.app

Post reply on HN
Print view View original

21–30 of 83 posts

Re: Show HN: Sesame - a local-first, open-source password manager

#21

Post by alacritas0 »

d0mkaaa wrote: post #3
ramon156 wrote: post #2

how does this compare to vaultwarden + bitwarden? my only concern there is that VW can throw self-host support out the door whenever they like. not that they'd have a reason to

vaultwarden + bitwarden is way more mature right now, but the main difference is that sesame is local-first by design. Vaultwarden also depends on staying compatible with bitwarden's clients/api, while this owns the whole stack

bitwarden clients are open source, so it would be possible to fork them if bitwarden ever makes user unfriendly decisions

Re: Show HN: Sesame - a local-first, open-source password manager

#23

Post by gonzalohm »

d0mkaaa wrote: post #5
gregable wrote: post #4

How does it compare to KeePassXC?

KeePassXC is definitely much more mature right now. I mean, Sesame is similar in being local-first and not requiring a cloud service, but I am aiming for a more modern consumer style experience. There is still a lot of work ahead to get it up to speed. I might also build more products around it eventually, so there’s a consistent ecosystem. (and of course, it would be great to eventually surpass some of the existing…

What do you mean by a "consumer style experience"?

Re: Show HN: Sesame - a local-first, open-source password manager

#24

Post by epihelix »

danielmartins wrote: post #22

I still don’t get why password managers builders think it’s a great idea to store MFA token together with the password, totally defeating the purpose of MFA in the first place.

I use this for MFA that's forced upon me, rather than MFA I request and want.

(It still protects against a password leak, though, so doesn't entirely defeat the purpose of MFA.)

Re: Show HN: Sesame - a local-first, open-source password manager

#25

Post by mirzap »

danielmartins wrote: post #22

I still don’t get why password managers builders think it’s a great idea to store MFA token together with the password, totally defeating the purpose of MFA in the first place.

Not really. MFA still protects against the much more common case where the password itself is compromised, either through a breach, reuse, phishing, interception, bad storage, etc. An MFA code is short-lived and can’t simply be reused later, unlike a password.

Keeping the password and MFA secret in the same password manager reduces separation (if someone fully compromises your vault, they will gain access to both factors). But that doesn’t make MFA pointless; it just means it doesn’t protect you against that particular failure mode.

And if someone has full access to your password manager, you already have a much bigger problem.

Re: Show HN: Sesame - a local-first, open-source password manager

#26

Post by NewsaHackO »

gonzalohm wrote: post #23
d0mkaaa wrote: post #5

Earlier quoted context omitted.

KeePassXC is definitely much more mature right now. I mean, Sesame is similar in being local-first and not requiring a cloud service, but I am aiming for a more modern consumer style experience. There is still a lot of work ahead to get it up to speed. I might also build more products around it eventually, so there’s a consistent ecosystem. (and of course, it would be great to eventually surpass some of the existing…

What do you mean by a "consumer style experience"?

subscription style paid program, of course. Starting at 1 dollar a month now, until they get market penetration, then they will jack up prices (for increased opex, ostensibly). The classic SaaS playbook.

Re: Show HN: Sesame - a local-first, open-source password manager

#28

Post by NewsaHackO »

arlattimore wrote: post #7

I like that this could be self hosted. I don't have anything against the big password managers (I use and pay for one), but they are a massive target for hackers for obvious reasons. If everyone could self host their own vault on a personal domain, the reward for hackers is much more difficult to get access to.

>I like that this could be self hosted.

For now. I note that all of the repos that are attached to the project have a license except sesame-server, which I do not think is an accident.

Re: Show HN: Sesame - a local-first, open-source password manager

#29

Post by Aachen »

I loosely monitor new password managers that appear with surprising regularity on F-Droid. Most have security issues that can be trivially found. It's conceptually simple software (running strings through a function before writing it to disk): nice for learning a new language, but should everyone's practice implementation seriously land in stores? So I'm skeptical of any new ones appearing from scratch, praising all their features and slick UI, with no mention of what was wrong with the incredibly diverse set of existing password manager projects. A study I read a few months ago showed that old code has fewer bugs than new code, which seems intuitive but it's nice to have actual data on it as well

Why a whole new project that needs to re-learn the gotchas that the predecessors ran into? Could any grievances have been pull requests or, worst case, a fork?

Re: Show HN: Sesame - a local-first, open-source password manager

#30

Post by giancarlostoro »

thehamkercat wrote: post #19

A vibe-coded password-manager? Sure! where do i sign up?

I never thought about wanting an HN comment as a wearable shirt before, but this ones one I would buy. But seriously, I love Claude and building all sorts of projects, but something as crucial as a password manager is a little bit too risky.
Post reply on HN