Show HN: Sesame - a local-first, open-source password manager
I have been working on Sesame, an open-source password manager that keeps your vault local by default. You don't need an account to create or use a vault, and the hosted service never receives the vault itself. It's still early software and the independent security review isn't finished yet, so I am mainly interested in feedback, testing, and people looking through the code.
(Linux support is yet to be released on v0.1.2, but currently is in the works.)
Why a whole new project that needs to re-learn the gotchas that the predecessors ran into? Could any grievances have been pull requests or, worst case, a fork?
My answer is to more generally look for what's been around, whose authors haven't turned out to be malicious (even after 10+ years of being popular enough that they'd get the motherlode with one malicious update), have had good security responses and seemingly good security practices... so basically look at the oldest thing that meets your needs and search e.g. HN and read its Wikipedia to find out about any red flags. Compare that to two runner-ups
A specific feature I'd recommend is phishing-resistant browser integration, that is, autofill for the browser but it only suggests passwords that you've stored specifically for this website. If another domain asks for it, it shouldn't suggest it and that then raises alarm bells of like "did the website change domains or is someone pretending to be them?". There have been bugs in browser integrations but it's not that regular, you still need to be among the unlucky few that visit a malicious website or ad before it gets found out and fixed, and my professional opinion is that it's easily worth it (our company helps with custom/targeted phishing simulations) - just like the having of a password manager (single point of failure for (nearly) all your credentials) is a tradeoff in the first place that seems to generally pay off. Perhaps memorise a few strong passwords though, like for bank/broker login and such things that would be truly disastrous and also likely that someone has a use for the thing they hack (they're not going to care about your nudes nearly as much as when they can drain hard cash)
https://pwsafe.org/
I am really afraid of supply chain attack. It feels inevitible that this will happen.
my only thought is i should just roll my own personal password manager closed source.
Unless you want sync or other online functionality, you're almost certainly better off with an ancient version of some trusted password manager than with a custom implementation. And if you do, I'd still not necessarily recommend it, but then imo it depends on your experience/knowledge level (regardless of whether you use an LLM)
I've never heard of the one you mention so I can't say anything positive or negative about it. The page looks ancient enough that I... not immediately trust it blindly, but it speaks for it. They either care about stability (not jumping on the latest fashion trends) ...or it's abandoned and the last release might or might not be flawless :p
Which study? Old software has bugs that live for decades, even security bugs. I don't have a study to cite, just open bug trackers and CVE lists.
Found the reference (bless bookmark managers): https://security.googleblog.com/2024/09/eliminating-memory-s...
Relevant bits:
> vulnerabilities decay exponentially.
> A large-scale study of vulnerability lifetimes² published in 2022 in Usenix Security confirmed this phenomenon. Researchers found that the vast majority of vulnerabilities reside in new or recently modified code: [plot]
> This confirms and generalizes our observation⁴, published in 2021, that the density of Android’s memory safety bugs decreased with the age of the code, primarily residing in recent changes.
² https://www.usenix.org/conference/usenixsecurity22/presentat...
⁴ https://security.googleblog.com/2021/04/rust-in-android-plat...
Citing from [4]:
> The above analysis of the age of memory safety bugs in Android (measured from when they were first introduced) demonstrates why our memory-safe language efforts are best focused on new development and not on rewriting mature C/C++ code. Most of our memory bugs occur in new or recently modified code, with about 50% being less than a year old.
I admit it is difficult to infer your intention on the classification of "old code vs new code". I don't see evidence that new code is inherently worse than old code, including in the cited study. There is correlation that people forget lessons learned in the past, but that's as far as I would evaluate the data.
> vulnerabilities decay exponentially.
Because they get fixed over time. That isn't controversial. They also persist over time. The quoted observation depends on proactive maintenance. But proactive maintenance is also the only cause of new bugs by definition. "Recently modified code" stands out in the last paragraph. This study is not talking about stable code.
> Perhaps you meant "correct code", and not necessarily "old" or "stable" code.
That sounds like a circular statement to me: if the code is correct, it can't have bugs, because bugs are when it does something wrong. Calling it stable seems fair to me, idk which would be most precise and bestest choice of words but that hopefully conveys the concept of some software product that hasn't majorly changed but also isn't just abandoned (say, a part of Firefox that hasn't been rewritten in forever, but Mozilla continues to apply any fixes to it when bugs are reported), for which I think the statement holds
> The quoted observation depends on proactive maintenance.
Yeah, that's the issue with my original wording of "old", where I can totally see the other interpretation coming to mind first. It's not that people who lived longer ago wrote better code :p. Quite the opposite: the effect of awareness increases over the decades is very visible in my work as security tester
All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere.
To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy. Now as an attacker if I want to get the users whole database of 100 passwords I must trick them to tapping a blinking smartcard or touchid 100 times. Presumably the user would notice something is wrong, and stop. Damage control.
This is how I have been doing password management for over a decade with password store, the standard unix password manager. That tiny shell script is the -minimum- security any password manager must have.
I get that most major password managers like 1password and lastpass also get this wrong. I submit with a straight face that they have never let any capable security engineers near their products. They have a negligent design end to end and must not be replicated.
Anyone who corrects this, with a good UX solution, will win the password manager wars. It is so so so easy to do, so it is unthinkable only the CLI password manager written in bash bothers to do it.
Ask an LLM to implement it for you if you must, but no one has any excuse to skip the most basic security function of a password manager: do anything at all to protect it from malware.
The bar for password managers is in hell.
In some technical sense, not necessarily in popularity.
Random non technical executive goes to a login page, and a popup happens on an external device like a phone or keychain dongle, watch, or any secondary display that asks "Allow aws.amazon.com root access to open browser tab on laptop xyz?" and if the page you are on right now says "doordash.com" and you did not ask to decrypt aws root credentials, then you say "nope, that does not seem right" and the attack is stopped cold.
The first mistake was letting non technical executive have aws root access in the first place, but the password manager only releasing a single credential at a time with a physical button press on a trusted screen can still be a last line of defense for our most sensitive credentials.
Being user friendly and being able to have any defense at all against malware are not mutually exclusive.
So any device without touchid or a yubikey can't use a password manager without typing out your full master password every time you want to access any password?
The same hardware Microsoft, Google, and Apple use to verify you are running a "genuine" OS these days can also do general purpose encryption and decryption with rate limits and touch policies. Pick literally any of them. TPM, Passkeys, PIV, touchid, yubikeys, nitrokeys, the keycard to your last hotel room being touched on the hidden NFC reader most people do not know about under Dell touchpads. Use whichever one is the least shitty but not having a hardware anchor in a password manager is shipping a car without airbags.
Whenever you add a new secret, you have it encrypt a copy to ideally a smartcard on your keychain and as a hail mary to each of a quorum of of keys held by secure enclaves that run an open source remotely attestable VM using TDX or SEV-SNP for provably encrypted memory, proof it is not logging, etc. You can also shamir-split encrypt to m-of-n geodistributed key shares stored offline as a double hail mary. All of this would be automatic and transparent to the user.
When you add a new device you must approve from an existing device.
That cryptographic approval, ideally a passkey tap, can start a process to bulk decrypt passwords and re-encrypt them to the TPM key in the new device in a hosted remotely attestable secure enclave the device verifies. The user can be given a chance to cancel this transfer within a reasonable period of time like 48 hours. This extra time could be bypassed if a user has a second device attached to their account. A user could also release one credential at a time manually and explicitly on both devices following the usual rate limit rules etc, or bypass the limit if both devices can be directly connected, or use an offline recovery yubikey or last resort offline bootable recovery usb for expedited recovery as well, etc. Good to have multiple fallback recovery methods that tolerate at least one machine being compromised at all times.
This is just one example scheme. There are many many ways to solve this in a way users are protected without them having to learn to do anything more complicated than account recovery on any web service ever.
I really hope someone rips this off and runs with it. My team and I have open sourced everything required, as have many other teams.
Like if someone wants a password manager that either prompts them or requires a yubikey for every password, that's fine, but expecting everyone else to be on board with that isn't reasonable.
I'm not really willing to accept a level of convenience other than "unlocking my PC lets me autofill website auth without any additional steps", and I'm happy with the level of risk that exposes me to.
If you cannot be bothered to touch a device when it blinks in exchange for having defense against phishing and malware, then I am going to assume you believe you are magically immune to phishing and malware.
But sure, if the tiniest bit of effort is too much, there isn't really a good way to make passwords actually secure for you. Hopefully that doesn't have any totally unforeseeable consequences for you down the line.
To make a transaction several people around the world sign with hardware enclaves in their devices, or yubikeys/nitrokeys, and if the threshold of signatures is met, the enclave can permit bulk usage of key material that would not be safe to directly use locally.
The same enclaves that protect multi-billion dollar signing keys, can also be used to assist with secure policy-gated bulk transfer of passwords between the TPMs of different computers, among many other uses.
https://whitepaper.turnkey.com/
https://distrust.co/blog/enclaveos.html
https://caution.co
>All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere.
"""All""" they need is to get root? Most people access all key stuff on their own devices, and for the vast ultra super majority of the population and vital sites if their personal trusted device is rooted it's over regardless. Your "Now as an attacker if I want to get the users whole database of 100 passwords I must trick them to tapping a blinking smartcard or touchid 100 times" is total fucking make believe, completely ignoring normal things like RECOVERY FLOWS. If you have root on someone's computer and phone you have access to their email and probably messaging as well, and that will suffice to get into nearly everything including the majority of financial institutions (which even now have massive ones that don't even support HSMs at all, let alone leave no recovery route! looking at you Charles Schwab, with total client assets in excess of $12.5 trillion at the start of this year [0]). There isn't any need for "100 times" because most people don't have 100 different critical accounts, rather single digits or even just one actual one that has things like money or comms.
>This is how I have been doing password management for over a decade with password store, the standard unix password manager. That tiny shell script is the -minimum- security any password manager must have.
Literally laughing out loud here. If it's not easy enough for my friends in their 70s to use and like it's WORTHLESS to most security. Including on some level mine or yours, because security has key social/network effects beyond just individuals, stolen money, information, and access is used to fuel further security threats. Job #1 is to make something people like and works with most of what already exists. Otherwise it's yet another case of "ROTATE PASSWORDS EVERY 2 MONTHS NO USE X NUMBERS OH ALSO Y SPECIAL CHARACTERS NO NOT LIKE THAT" which results in everyone just leaving stuff on sticky notes on their screens and doing the bare minimum to fool the system and using the same thing or minor variants everywhere. Theorycrafted garbage made for robots not humans.
>I submit with a straight face that they have never let any capable security engineers near their products. They have a negligent design end to end and must not be replicated.
I submit with a straight face you are either literally working for a hostile agency to spread disinformation or you have serious neurodivergence or you are seriously and dangerously bubbled with an (un)healthy splash of Dunning-Kruger mixed in.
----
0: https://pressroom.aboutschwab.com/press-releases/press-relea...
Exfiltrate all plaintext credentials from 1password:
op list items \
Exfiltrate all plaintext credentials from lastpass:lpass ls \
Stick one of those in a dependency of a dependency of a dependency of a popular NPM package and you can get access to developer accounts at every sector of the tech industry.Super easy to avoid with minimal change to user experience, and yet no one did because "no one else does".
Except for Mooltipass and Password Store, which unfortunately no one has heard of. It is the popular options with billions of dollars not doing the basics the niche open source ones do that is so unforgivable.
I just wish to not see others repeating those mistakes and putting users at increased risk for no reason. I know someone personally who had their savings account wiped out because malware dumped their lastpass database. A malicious browser plugin to sniff the master password is all it takes without a hardware anchor.
https://www.1password.dev/cli/get-started
And getting secrets using it requires explicit authentication with password/fingerprint/etc (I forget if it’s per item or per process, but still).
Decrypting -all- passwords any time you decrypt -any- password under the hood is an irresponsible design for a password manager, especially on modern hardware with so so so many other options that enforce rate limiting, hardware anchored encryption, and physical user consent.
Performative 2FA for every secret like 1password does when the binary has direct access to bulk decrypt all secrets in plain text with a key in system memory is a very strange choice given you could just have the hardware doing the individual decryption for a single secret instead of exposing the secrets that can bulk decrypt the whole database.
I don't understand why anyone would use LastPass. [2]
[1] https://www.1password.community/developers-69/security-conce... [2] https://en.wikipedia.org/wiki/LastPass#Security_incidents
Granted, a lot of services basically design their service for the common denominator of people using sticky notes by instituting rate limits, requiring 2FA, etc.
(and of course, it would be great to eventually surpass some of the existing projects :) )
(It still protects against a password leak, though, so doesn't entirely defeat the purpose of MFA.)
By and large, I see it as protection for the service provider, not for the me - they prevent the service provider from having to deal with people using weak passwords or re-using passwords that get leaked.
By-and-large, given the option, I wouldn't enable MFA - I appropriately store my strong, unique passwords, and am satisfied with that level of security.
Having MFA forced on my is purely a convenience downgrade without any real security upgrade, and having my password manager automatically fill MFA tokens minimizes that convenience downgrade.
Keeping the password and MFA secret in the same password manager reduces separation (if someone fully compromises your vault, they will gain access to both factors). But that doesn’t make MFA pointless; it just means it doesn’t protect you against that particular failure mode.
And if someone has full access to your password manager, you already have a much bigger problem.
In the way where there would be a server (selfhosted) that has the passwords and is well protected. Then, on the server, I can configure access to the secrets on my clients and — and that is important — restrict the number of secrets that can be accessed per time. And on each client I want to be told if secrets got accessed by another client.
Because, optimally I would use passkeys and other means of authentication, except for initial auth. But if my client gets compromised I don't want it to be able to access and exfiltrate all secrets at once. That is basically the worst case scenario.
I don't understand why it's not common in password managers to have different categories of how important a secret is and better control/transparency to detect compromised clients and contain the impact.
And the server also needs to inform about usages, since otherwise a compromised client could just extract everything slowly over time.
Does that make sense?
Otherwise, basically just one compromised client means that suddenly all my credentials need to be considered stolen and have to be changed everywhere.
For now. I note that all of the repos that are attached to the project have a license except sesame-server, which I do not think is an accident.
I wouldn't trust any password manager or critical applications like this written after 2024
bitwarden/KeePassXC are already more than enough
0 - https://www.pwsafe.org/relatedprojects.shtml