9 ms·

New, portable, open source password manager for Windows

52 points by nvr82 7y ago

gruez 7y ago
Why this over keepass? Also, a quick skim of the source code shows that the program keeps the decrypted file on-disk[1]. That seems like a huge vulnerability if you don't have FDE enabled. [1] https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/MainWindow.cs#L175 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd... https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/EncryptionAES.cs#L154 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...
- deleted 7y ago
  [deleted]
- regecks 7y ago
  I think you need FDE no matter what. e.g. Hibernation will dump your passwords to disk, even if they're only kept in in unmanaged, VirtualProtect'ed memory.
- akx 7y ago
  Yeah, that looks suspect. Maybe open a GitHub issue about it?
- jakobdabo 7y ago
  And they are doing MAC-then-Encrypt in 2019. The author may be a great person and an excellent software developer, but they are an amateur in applied cryptography. Use with caution.
keltex 7y ago
Another one I've used for years is password safe: https://pwsafe.org/ https://pwsafe.org/ Free and open source.
- phs318u 7y ago
  Same. And I'm surprised by how rarely it gets mentioned in these kind of HN discussions. I would have thought given it's origins (originally designed by Bruce Schneier and open-sourced in 2002 [0]), it would have a bigger following. [0] https://www.pwsafe.org/history.shtml https://www.pwsafe.org/history.shtml
loop0 7y ago
I’ve been using Bitwarden for a little more than a month and it is by far the best password manager I used. And being open source is a very nice bonus. I’m going for tue paid option to support the company behind it.
- mehrdadn 7y ago
  Does it have the following? They're what have kept me stuck on KeePass: - Browser integration (a single key combo unlocking & filling in passwords) - OTP support - SSH agent and key storage - Entry-level (rather than file-level) synchronization - Google Drive synchronization - Automatic history maintenance - Storing arbitrary additional data - Icons (makes identifying entries so much faster)
  - steve19 7y ago
    It has browser integration but it has a client server model so there is nothing to sync with gdrive or Dropbox. So it's more like lastpass than keypass. You can host your own server and there is at least one alternative server implementation.
  - maccard 7y ago
    It does have a decent browser integration, OTP support, history support (last 5 passwords) support for arbitrary additional data and icons. Having not read the source code, or investigated the details, my understanding is the sync is entry based over file based. On multiple occasions I lost data to Keepass's insane lack of sync functionality, I've never once done the same with Bitwarden. Google drive sync is kind of moot as the sync happens on a server (which you can run yourself).
    - mehrdadn 7y ago
      > my understanding is the sync is entry based over file based > Google drive sync is kind of moot as the sync happens on a server Confused, so are you saying there is a server that does entry-based syncing? KeePass it's the KeePass client that resolves conflicts at the entry level with whatever is on Google Drive (which it connects to via plugins).
deleted 7y ago
[deleted]
mrgalaxy 7y ago
This is nice and all, but what am I going to do with a Windows only password manager? I use several different OSs and a phone. It's pretty much a must that my password manager works on all of them.
NoPicklez 7y ago
But this can't go everywhere my password are needed, why would I use this? Not to be harsh, but LastPass (and others) works across Mac, PC, IOS & Android in multiple ways. A password manager to a degree needs to make my life easier, this means being portable and compatible.
Someone 7y ago
Portable… for Windows? It’s a .Net application using Windows Forms. That’s open sourced, and thus portable in theory. In practice, it’s Windows only. Turns out they use a different meaning of “portable”: ”Open source version of Ylva is available as a single binary file which is portable by default. You can run it from a USB stick.”
- santoshalper 7y ago
  In the world of Windows applications, portable means that the program can be run without any installation or storing anything locally. So you could run it off a usb or other portable storage. This is a common usage.
- d76d6776yudsy 7y ago
  https://portableapps.com/ https://portableapps.com/
- deleted 7y ago
  [deleted]
whatl3y 7y ago
I unfortunately agree with the sentiment of others from this only being supported on windows. I built a CLI password manager[1] sort of as a learning exercise, but to this day I use it daily and have over 250 accounts managed in it. I temporarily back up the encrypted file to S3 in case my computer blows up, but for some reason I have a small sense of satisfaction that my passwords don’t live in a 3rd party like LastPass, even though I’m aware of the auditing and scrutiny they go through consistently to maintain credibility for what they do. [1] https://github.com/whatl3y/hide https://github.com/whatl3y/hide
- captn3m0 7y ago
  LastPass has been breached 3 times, and they’ve had RCEs in their Chrome Extensions.
tenebrisalietum 7y ago
I tried this briefly under Wine in Linux. On the surface it doesn't look like it has 2 features I really like about Keepass: - Folders. I like using folders and subfolders to keep related sets of passwords together. - Support for attachments. Keepass lets me keep track of keyfiles, notes, and certificates in addition to passwords. Ylva has a notes field but I really like Keepass's ability to attach files. The QR integration is interesting I guess, I don't have any apps that allow QR code for password input but if I did it would be useful.
ejcx 7y ago
The first thing I do whenever someone writes their own password manager is to read the Encrypt function. This one is AES-CBC with its own hand rolled integrity scheme. Not very strong by modern standards
- beefhash 7y ago
  Doesn't look very hand rolled to me. It's standard HMAC. The only unusual thing is the timing-unsafe comparison[1], which probably needs fixing. It looks like an attempt was made at a constant-time comparison (|= ^ pattern sure looks like it), but the early return breaks it again. I'm not sure if much can be gained from a timing attack in this particular instance though, since the key fully depends on user input in the first place. (By the way, even Microsoft's own documentation doesn't use constant-time comparisons for HMAC[2]!) [1] https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/EncryptionDataIntegrity.cs#L38-L44 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd... [2] See the example on https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.hmacsha256?view=netframework-4.8 https://docs.microsoft.com/en-us/dotnet/api/system.security....
  - ejcx 7y ago
    I'm not a C# expert by any means. Is the IntegrityHash of the plaintext, and not the ciphertext? https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/EncryptionAES.cs#L78 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd... That would be a really serious flaw. If not, hand rolled AES-CBC-SHA256.... why not just use an AEAD implementation? This is exactly why I look at these. There's a lot of nuance to that one decision, and so it usually gives quite a bit of signal about the project as a whole.
    - d76d6776yudsy 7y ago
      Pretty thick are ya? Parent is telling you it doesn't look hand rolled and you...
aasasd 7y ago
Hmm, I guess this year everyone writes their own password manager. (Can we have a year of fast PIM outliners? The competition is pretty sparse there.)
bboygravity 7y ago
All password managers and form fillers I've tried are quite terrible at correctly finding and filling fields/text boxes. They all seem to rely on finding patterns for things to fill from code. Which doesn't work. As there is no clear pattern accross billions of non-standard web-forms. Does anybody know of pw managers that work using image recognition (OCR-like) on the GUI to find fillable fields? AKA: using the same form-API that humans do?
- ubercow13 7y ago
  I would guess that it wouldn't be worth the hassle of the inevitable inaccurate identifications. The most ergonomic password entry tool I've used is rofi-pass [1]. It's so effortless that I don't think anything smarter could improve on it in practice. It works in a predictable and way in any application (eg SSH pw in a terminal) without any complex integrations being needed and once you get used to using the hotkey it's basically as quick as form autofilling. [1] https://github.com/carnager/rofi-pass https://github.com/carnager/rofi-pass
- kuzimoto 7y ago
  Hmm unfortunately I don't have an answer for your question. Though sounds like KeePass is the next best thing. You can define custom auto-type patterns, for forms that don't follow the typical <username><tab><password><enter> format. It's great for saving ftp sites for filezilla, or ssh logins.
stevekemp 7y ago
As soon as I saw "verkkokauppa" in the list I assumed it was a Finnish developer. It looks like a nice project, but I'd echo the other compaints - having a tree, or folders, would make it much more useable. I tend to have a structure which looks like this (simplified): Git/ github.com gitlab.com Servers/ ssh.example.com/ root.txt ssh.example.org/ webmail.txt Websites/ lwn.net Having all the items in a flat list soon becomes very crowded. Checking my own password store I have over 300 entries.
ComodoHacker 7y ago
Not a single word about how security features are implemented. Not very convincing for HN audience.
- eps 7y ago
  Please don't take on yourself to speak for everyone even if the point itself is valid. That's been bad manners since the BBS days if not earlier.
walrus01 7y ago
What does this achieve over the feature set of keepassx?
runxel 7y ago
No, please not another password manager... I have not looked into it much, but hell, it looks like it even ships its own crypto.
dusted 7y ago
I'll shamelessly plug my own open source password manager, not because it's mine but because I believe it is better. And it is more portable, just put it in your pocket! It's at https://finalkey.net/ https://finalkey.net/
rekshaw 7y ago
The title is a bit of an oxymoron. "...portable...for Windows"
- detaro 7y ago
  In the context of Windows applications, "portable" is also used to mean "runs without installation/further dependencies, you can just run it from a folder somewhere".
noisy_boy 7y ago
I have been using Keepassx[1] with Syncthing[2] for synchronizing the password database. It has been a great experience due to following reasons beyond the crypto advantages: - Open source - Peer to peer without having to share file contents with central server like Dropbox etc. - Full featured Android and Linux (KeepassXC) clients with nice UIs (on Android I have the option of using fingerprint auth to open my database) - Autofill integration on Android (I haven't tried on Linux) [1]: https://www.keepassx.org/ https://www.keepassx.org/ [2]: https://syncthing.net/ https://syncthing.net/
- m-p-3 7y ago
  I use KeeWeb[1] on MacOS, iOS and Windows, and KeePass2Android[2] on my Android device which has decent autofill. They all also supports cloud storage natively, so I don't have to worry about keeping them in sync. I do use Syncthing for other stuff though. [1]: https://keeweb.info/ https://keeweb.info/ [2]: https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi...
pnunesc 7y ago
I use Passbolt at work for a geo-deslocated team and it works very good.

52 points by nvr82 7y ago

Why this over keepass? Also, a quick skim of the source code shows that the program keeps the decrypted file on-disk[1]. That seems like a huge vulnerability if you don't have FDE enabled. [1] https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/MainWindow.cs#L175 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd... https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/EncryptionAES.cs#L154 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...

deleted 7y ago
[deleted]
regecks 7y ago
I think you need FDE no matter what. e.g. Hibernation will dump your passwords to disk, even if they're only kept in in unmanaged, VirtualProtect'ed memory.
akx 7y ago
Yeah, that looks suspect. Maybe open a GitHub issue about it?
jakobdabo 7y ago
And they are doing MAC-then-Encrypt in 2019. The author may be a great person and an excellent software developer, but they are an amateur in applied cryptography. Use with caution.

keltex 7y ago

Another one I've used for years is password safe: https://pwsafe.org/ https://pwsafe.org/ Free and open source.

phs318u 7y ago
Same. And I'm surprised by how rarely it gets mentioned in these kind of HN discussions. I would have thought given it's origins (originally designed by Bruce Schneier and open-sourced in 2002 [0]), it would have a bigger following. [0] https://www.pwsafe.org/history.shtml https://www.pwsafe.org/history.shtml

loop0 7y ago

I’ve been using Bitwarden for a little more than a month and it is by far the best password manager I used. And being open source is a very nice bonus. I’m going for tue paid option to support the company behind it.

mehrdadn 7y ago
Does it have the following? They're what have kept me stuck on KeePass: - Browser integration (a single key combo unlocking & filling in passwords) - OTP support - SSH agent and key storage - Entry-level (rather than file-level) synchronization - Google Drive synchronization - Automatic history maintenance - Storing arbitrary additional data - Icons (makes identifying entries so much faster)
- steve19 7y ago
  It has browser integration but it has a client server model so there is nothing to sync with gdrive or Dropbox. So it's more like lastpass than keypass. You can host your own server and there is at least one alternative server implementation.
- maccard 7y ago
  It does have a decent browser integration, OTP support, history support (last 5 passwords) support for arbitrary additional data and icons. Having not read the source code, or investigated the details, my understanding is the sync is entry based over file based. On multiple occasions I lost data to Keepass's insane lack of sync functionality, I've never once done the same with Bitwarden. Google drive sync is kind of moot as the sync happens on a server (which you can run yourself).
  - mehrdadn 7y ago
    > my understanding is the sync is entry based over file based > Google drive sync is kind of moot as the sync happens on a server Confused, so are you saying there is a server that does entry-based syncing? KeePass it's the KeePass client that resolves conflicts at the entry level with whatever is on Google Drive (which it connects to via plugins).

deleted 7y ago

[deleted]

mrgalaxy 7y ago

This is nice and all, but what am I going to do with a Windows only password manager? I use several different OSs and a phone. It's pretty much a must that my password manager works on all of them.

NoPicklez 7y ago

But this can't go everywhere my password are needed, why would I use this? Not to be harsh, but LastPass (and others) works across Mac, PC, IOS & Android in multiple ways. A password manager to a degree needs to make my life easier, this means being portable and compatible.

Someone 7y ago

Portable… for Windows? It’s a .Net application using Windows Forms. That’s open sourced, and thus portable in theory. In practice, it’s Windows only. Turns out they use a different meaning of “portable”: ”Open source version of Ylva is available as a single binary file which is portable by default. You can run it from a USB stick.”

santoshalper 7y ago
In the world of Windows applications, portable means that the program can be run without any installation or storing anything locally. So you could run it off a usb or other portable storage. This is a common usage.
d76d6776yudsy 7y ago
https://portableapps.com/ https://portableapps.com/
deleted 7y ago
[deleted]

whatl3y 7y ago

I unfortunately agree with the sentiment of others from this only being supported on windows. I built a CLI password manager[1] sort of as a learning exercise, but to this day I use it daily and have over 250 accounts managed in it. I temporarily back up the encrypted file to S3 in case my computer blows up, but for some reason I have a small sense of satisfaction that my passwords don’t live in a 3rd party like LastPass, even though I’m aware of the auditing and scrutiny they go through consistently to maintain credibility for what they do. [1] https://github.com/whatl3y/hide https://github.com/whatl3y/hide

captn3m0 7y ago
LastPass has been breached 3 times, and they’ve had RCEs in their Chrome Extensions.

tenebrisalietum 7y ago

I tried this briefly under Wine in Linux. On the surface it doesn't look like it has 2 features I really like about Keepass: - Folders. I like using folders and subfolders to keep related sets of passwords together. - Support for attachments. Keepass lets me keep track of keyfiles, notes, and certificates in addition to passwords. Ylva has a notes field but I really like Keepass's ability to attach files. The QR integration is interesting I guess, I don't have any apps that allow QR code for password input but if I did it would be useful.

ejcx 7y ago

The first thing I do whenever someone writes their own password manager is to read the Encrypt function. This one is AES-CBC with its own hand rolled integrity scheme. Not very strong by modern standards

beefhash 7y ago
Doesn't look very hand rolled to me. It's standard HMAC. The only unusual thing is the timing-unsafe comparison[1], which probably needs fixing. It looks like an attempt was made at a constant-time comparison (|= ^ pattern sure looks like it), but the early return breaks it again. I'm not sure if much can be gained from a timing attack in this particular instance though, since the key fully depends on user input in the first place. (By the way, even Microsoft's own documentation doesn't use constant-time comparisons for HMAC[2]!) [1] https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/EncryptionDataIntegrity.cs#L38-L44 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd... [2] See the example on https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.hmacsha256?view=netframework-4.8 https://docs.microsoft.com/en-us/dotnet/api/system.security....
- ejcx 7y ago
  I'm not a C# expert by any means. Is the IntegrityHash of the plaintext, and not the ciphertext? https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd7fa4bd58954b457dd6/Ylva/EncryptionAES.cs#L78 https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd... That would be a really serious flaw. If not, hand rolled AES-CBC-SHA256.... why not just use an AEAD implementation? This is exactly why I look at these. There's a lot of nuance to that one decision, and so it usually gives quite a bit of signal about the project as a whole.
  - d76d6776yudsy 7y ago
    Pretty thick are ya? Parent is telling you it doesn't look hand rolled and you...

aasasd 7y ago

Hmm, I guess this year everyone writes their own password manager. (Can we have a year of fast PIM outliners? The competition is pretty sparse there.)

bboygravity 7y ago

All password managers and form fillers I've tried are quite terrible at correctly finding and filling fields/text boxes. They all seem to rely on finding patterns for things to fill from code. Which doesn't work. As there is no clear pattern accross billions of non-standard web-forms. Does anybody know of pw managers that work using image recognition (OCR-like) on the GUI to find fillable fields? AKA: using the same form-API that humans do?

ubercow13 7y ago
I would guess that it wouldn't be worth the hassle of the inevitable inaccurate identifications. The most ergonomic password entry tool I've used is rofi-pass [1]. It's so effortless that I don't think anything smarter could improve on it in practice. It works in a predictable and way in any application (eg SSH pw in a terminal) without any complex integrations being needed and once you get used to using the hotkey it's basically as quick as form autofilling. [1] https://github.com/carnager/rofi-pass https://github.com/carnager/rofi-pass
kuzimoto 7y ago
Hmm unfortunately I don't have an answer for your question. Though sounds like KeePass is the next best thing. You can define custom auto-type patterns, for forms that don't follow the typical <username><tab><password><enter> format. It's great for saving ftp sites for filezilla, or ssh logins.

stevekemp 7y ago

As soon as I saw "verkkokauppa" in the list I assumed it was a Finnish developer. It looks like a nice project, but I'd echo the other compaints - having a tree, or folders, would make it much more useable. I tend to have a structure which looks like this (simplified): Git/ github.com gitlab.com Servers/ ssh.example.com/ root.txt ssh.example.org/ webmail.txt Websites/ lwn.net Having all the items in a flat list soon becomes very crowded. Checking my own password store I have over 300 entries.

ComodoHacker 7y ago

Not a single word about how security features are implemented. Not very convincing for HN audience.

eps 7y ago
Please don't take on yourself to speak for everyone even if the point itself is valid. That's been bad manners since the BBS days if not earlier.

walrus01 7y ago

What does this achieve over the feature set of keepassx?

runxel 7y ago

No, please not another password manager... I have not looked into it much, but hell, it looks like it even ships its own crypto.

dusted 7y ago

I'll shamelessly plug my own open source password manager, not because it's mine but because I believe it is better. And it is more portable, just put it in your pocket! It's at https://finalkey.net/ https://finalkey.net/

rekshaw 7y ago

The title is a bit of an oxymoron. "...portable...for Windows"

detaro 7y ago
In the context of Windows applications, "portable" is also used to mean "runs without installation/further dependencies, you can just run it from a folder somewhere".

noisy_boy 7y ago

I have been using Keepassx[1] with Syncthing[2] for synchronizing the password database. It has been a great experience due to following reasons beyond the crypto advantages: - Open source - Peer to peer without having to share file contents with central server like Dropbox etc. - Full featured Android and Linux (KeepassXC) clients with nice UIs (on Android I have the option of using fingerprint auth to open my database) - Autofill integration on Android (I haven't tried on Linux) [1]: https://www.keepassx.org/ https://www.keepassx.org/ [2]: https://syncthing.net/ https://syncthing.net/

m-p-3 7y ago
I use KeeWeb[1] on MacOS, iOS and Windows, and KeePass2Android[2] on my Android device which has decent autofill. They all also supports cloud storage natively, so I don't have to worry about keeping them in sync. I do use Syncthing for other stuff though. [1]: https://keeweb.info/ https://keeweb.info/ [2]: https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi...

pnunesc 7y ago

I use Passbolt at work for a geo-deslocated team and it works very good.