hide

- Wow apologies you’re exactly right, I just converted this from JS to typescript and instead of making this variable null | undefined | string, i made it a string and added a default as a shortcut to get it released. Apologies for questioning this will fix it asap, if nothing else I get some peer review when publishing a Show HN :) https://github.com/whatl3y/hide/blob/5ee54aad1b1c3da4d186568... - Got it, yeah I guess my defense would be it still requires the user to make a conscious decision so it’s not as bad as it being ambiguous or unclear, although removing the ability to control this via env var might be the right move. - I’ll look into and add something to do this soon :)

- config.cryptography.password is always set to a default value if not provided, it will never hit your error case [0]. This is trivially verifiable and I suggest you try it. - no, you accept the algorithm as an environment variable - someone can install your package as is and still set it themselves - as kohtatsu mentioned you should be using a key derivation function. [0]: https://github.com/whatl3y/hide/blob/1c3aaca634f504c3c274bac...

- for you first point, this is not true[0]. can you provide a reference? - for your second point, if you want to fork this repo and use another algo, go for it. if you install the package from npm and use it or clone and install from source without changing it, it uses the default AES256 - this could be argued as a valid point, and maybe forcing the user to use 32 bytes as their password is the right way to do it, but no 3rd party password manager forces this limitation so i don’t believe I should? Maybe just forcing a password difficulty is the right way to go? I’m certainly open to ideas, this is just a small project i enjoyed building and feel like the minimum security requirements to meet my needs are there. [0]: https://github.com/whatl3y/hide/blob/1c3aaca634f504c3c274bac...

This seems dangerous to use? Just a few issues looking at the code: - No master password is required - if you don't set one a default value of "hide" is used - The description says it uses AES256 (it is the default) but the code lets you specify your own algorithm, and supports ECB mode and even Triple DES - When an algorithm requires a (for instance) 32 byte key, and your master password is larger than 32 bytes, it will just take the first 32 bytes and ignore the rest. If your master password is less than 32 bytes, it will just keep concatenating your password with itself until it gets 32 bytes: https://github.com/whatl3y/hide/blob/master/src/libs/Encrypt...

Couldn't find a PBKDF, closest code-wise I could find is this; https://github.com/whatl3y/hide/blob/1c3aaca634f504c3c274bac... Edit: looks like you had bcrypt then decided to remove it? https://github.com/whatl3y/hide/commit/0a8262d50929366bdd9ae... You don't need to compare, just feed the resulting hash to AES and see if the output is any good.

I built this to allow me to manage my passwords on my machine without sending them to any third party. The data lives on your machine encrypted with a master password, but the encrypted data never has to leave your machine or network: https://github.com/whatl3y/hide I need it almost daily. Being a developer and almost always in a terminal it’s convenient to retrieve a password really quick when needed.

I unfortunately agree with the sentiment of others from this only being supported on windows. I built a CLI password manager[1] sort of as a learning exercise, but to this day I use it daily and have over 250 accounts managed in it. I temporarily back up the encrypted file to S3 in case my computer blows up, but for some reason I have a small sense of satisfaction that my passwords don’t live in a 3rd party like LastPass, even though I’m aware of the auditing and scrutiny they go through consistently to maintain credibility for what they do. [1] https://github.com/whatl3y/hide