7 ms·

rand() [1] is not a secure source of randomness. I strongly recommend against using that password manager since it is not secure. [1] https://github.com/oormic

• badrabbit 8y ago
  +1 hope this comment is top. They use it for salt and password generation: https://github.com/oormicreations/OormiPass/blob/1a6f0b99613bb7020edb01cc91b6aafb44025f8d/src/oormipassMain.cpp#L966 https://github.com/oormicreations/OormiPass/blob/1a6f0b99613... Also, > The master password is not stored. An SHA256 salted hash is stored instead. Have they heard of scrypt or argon2? And they're not using a KDF(!!!!!!) With sha256. Dear Authors,if you ever read this,please look at: https://cryptopp.com/wiki/Key_Derivation_Function https://cryptopp.com/wiki/Key_Derivation_Function And https://cryptopp.com/wiki/RandomNumberGenerator https://cryptopp.com/wiki/RandomNumberGenerator
  • deleted 8y ago
    [deleted]
• hn_throwaway_99 8y ago
  All of these top comments remind me of the general adage that encryption and security are really hard, and if you think you know what you're doing you probably don't. I don't want to be too harsh for a ShowHN, but even if the authors fixed the several bugs that have already been reported here, it's clear they don't have a foundational enough understanding of cryptography and security to be writing a password manager. I would suggest they spend more time understanding the basics first.