Secret Scribble

An offline, open-source password manager for Windows

65 followers

An offline, open-source password manager for Windows

65 followers

A simple, open-source password manager that encrypts and manages your files locally. Includes basic features and some unique. It is also a good template for you to build upon your own, custom password manager that fits your needs!

Free

Launch tags:Productivity•Open Source•Privacy

Launch Team

Tines The single, secure environment for agents, apps, and automations.

Promoted

Da Deep Search

Maker

📌

Hello product hunt community, Today I am publishing a 4 month project of mine, Secret Scribble. It is an open-source, offline password manager. It began as a personal project, but now it can serve as a template for anyone looking to build their own custom password manager! It’s also a good standalone product that’s very simple to use. Essentially, it functions as a text editor that allows you to encrypt and decrypt text documents with a password. You can download it directly from its website for free and install it through an easy, standard process. The code may be a bit rough and could have minor security flaws, but you’re welcome to contribute and help improve it! You can find it on my GitHub [https://github.com/Drimiteros/Se...], where you’ll also find instructions on linking.

Report

2yr ago

Wingback

Hey @drimiteros, from a cursory glance: - You are not using a password derivation function on the user-provided password/key. There is some weird shuffling going on in the "grade" function, but that is very predictable, and I wouldn't even call it a "weak" password derivation function. - You are using AES CBC mode with a fixed, never changing, null-byte IV. Apart from the fact that CBC is no ideal for this kind of application, you *have* to use a unique, random IV for every ciphertext and *never* re-use it. CBC also lacks authentication. - Less critical, but bad practice: You are using rand() to generate random passwords. The c/c++ standard does not give any guarantees for the rand() function that would make it suitable for anything secure/related to cryptographic operations. You also seed it with srand(time(0)), which means that the output of the password generator is predictable. - Lastly, you leaked your own loginInfo.txt, which given the weak password derivation could potentially allow someone to recover your password. Unfortunately, this is all very bad. While I generally encourage others to get into cryptography and security and to not be afraid to play around with it, publishing and advertising this project like this seems at least somewhat irresponsible. I highly encourage you to read up on: - AES cipher modes, including modern ones with authentication (e.g., AES-GCM). - What IVs actually do and why they need to be unique and random for each encryption operation. - Password derivation functions (e.g., PBKDF2, bcrypt, or Argon2) to securely derive cryptographic keys from passwords. - Cryptographically secure random number generators (CSPRNGs) - How other password managers handle encryption, key management, etc. You might also want to look at key wrapping techniques. I would also recommend adding a proper disclaimer on top the GH project highlighting that this is a toy project and currently not suitable for real-world use. I hope this message does not sound to discouraging and I that you'll keep going at it - everyone has to start somewhere!

Report

2yr ago

Da Deep Search

Maker

@yann_leretaille Hey! Valid points, I will be preparing a reply to your issue on GitHub for the technical stuff. Stay tuned! 🙂

Report

2yr ago

Wingback

@drimiteros Sounds good! I'll keep an eye out!

Report

2yr ago

Hi @drimiteros. Congratulations for crating such a product. I can see how much effort has gone into it. It's great that it's open source, and the choice of technologies is interesting. It would be nice to build it for MacOS as well. I'd like to mention few things I noticed: 1) In the description, it's listed as a password manager, on website as a file encryptor, and in the screenshot - there is a password generator. :) 2) I think it would be a good idea to add a link to the GitHub repository on the landing page - it would increase trust in the product. 3) The idea of showing a screenshot of the current development is great. I would suggest considering a tool that allows you to publish a public development roadmap. Good luck with your project!

Report

2yr ago

Easy Bookmark Viewer

@drimiteros Hi, I like the product, but I’m still not convinced why I should change from LastPass. Does it offer any unique features?

Report

2yr ago

Da Deep Search

Maker

@himanshuraikwar Hi there! Well, it is not ment to replace any major password manager, if you are happy and used to something you should propably keep using it. It is basically a text editor that encrypts your data, made for people that want soething simple & secure. You can visit the website and see the current and upcoming features for the app and see if there is something you find valuable, there is a trello page for it as well. Also this is an open-source software and anyone can modify it and implement features that they like! If you don't code you can request a fature that you like here: https://tally.so/r/wzeMva

Report

2yr ago

Congrats on the launch! This looks like a great, simple solution for managing passwords securely. Any plans for adding more features down the line?

Report

2yr ago

Da Deep Search

Maker

@ihuzaifashoukat Yes! You can see what is in the works in the download section in the app's website! For a more detailed roadmap you can visit the app's trello page: https://trello.com/b/HFSmdyyM/se...

Report

2yr ago

Reviews