PWpwg·Jun 23, 2020
PasswordGorilla: https://github.com/zdia/gorilla/wiki
In Ask HN: What password manager do you use?zdia
gorilla
Tcl2010–2020
zdia / gorilla
gorilla
Password Gorilla manages passwords
4Distinct people
40Mentions
1Explicit recommenders
427GitHub stars
What to know before exploring
What it is
Password Gorilla manages passwords
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
Don't use the built in password storage of any browser. Doing so leaves you vulernable to bugs such as this one: http://forum.avast.com/index.php?topic=25044.0;wap2. I.e., if a…
pwg used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year40 dated mentions
Observed mentions: 2010-09-15 19:13:14 UTC to 2020-06-23 18:43:46 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2010 | 2010-01-01 00:00:00 UTC | 2011-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2011 | 2011-01-01 00:00:00 UTC | 2012-01-01 00:00:00 UTC | 14 | 1 | 13 |
| 2012 | 2012-01-01 00:00:00 UTC | 2013-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
40 sourcesPassword Gorilla
https://github.com/zdia/gorilla/wiki
In Ask HN: What password manager do you use?I use Password Gorilla: https://github.com/zdia/gorilla/wiki
In Ask HN: How do you manage your passwords?I use PasswordGorilla (https://github.com/zdia/gorilla/wiki)
In Ask HN: What password manager tools do you use or recommend?I use Password Gorilla (https://github.com/zdia/gorilla/wiki) on Linux and Windows and use the PasswdSafe app on Android (https://sourceforge.net/p/passwdsafe/wiki/Home/). Both use the same file format (the Password Safe format) and so far the Android app has never crashed on me.
In Ask HN: What password managers do you use?> There aren't that many different schemes. Maybe a grand total of three dozen? I think that the program can simply have a user-updated registry (perhaps that's shared) of schemes, and the generator accounts for this.
> Making them remember an integer that will rarely be larger than 3 instead of a password seems awesome.
Ok, so, we have the "master seed" that has to be remembered. We also now have to remember X from [1..36] of schemes, and a Y version integer.
There's two ways to "remember" these triplets. In your head. I which case you have to remember, for all 50 [1] different logins to all the sites you have, a triplet of <master,scheme,version>. Master will be easy, as it will be typed enough times to be easily remembered. But remembering that site A, that has not been visited for 4 months, used <master,14,2> while site B, that a
Read the rest
s not been visited for 6 months, used <master,27,3> and so on for 50+ logins will be untenable.
Or your 'deterministic' generator really has to store the "scheme" and "version" parts of the triplet somewhere in a local file/db, associated with each site, to allow it to work. At which point, you are 80% of the way to a proper password manager that would allow each password to simply be a proper randomly generated string of characters, tailored as need be, for each site.
> Worse case scenario, they can keep trying until they get the right one.
Unless, because of breeches or general password rotation they are now up to "version 12", but the site only allows three tries until lockout. Now you have to start trying "within 3 steps" of 12 or else you are guaranteed to be locked out.
[1] In the manager I use (Password Gorilla, https://github.com/zdia/gorilla, which is one of the many Password Safe compatible managers) I've got 371 stored entries, of which 285 are actual passwords for various sites that wanted a registration of some form or another along the way. That is something you learn quickly when you start using a password manager. The sheer number of websites that want you to 'register' in some way or another is actually huge. This is after about 13 or so years of using a password manager.
Wait? You mean you answer those questions with real data?
My answers to those (when required) always look like this:
> “What was the name of your first pet?”
JBK?a0ly(VE3E-|-@BADZFPS<1Fh$X23
Where the "goop" is generated, and remembered, by my password manager (https://github.com/zdia/gorilla/wiki).
In New NIST password guidelines: don't require character types or rotationWhat you use as an example input is not the point. Your entire scheme is insecure. It is a fully deterministic scheme from input to output, and reversible as well given your suggestion of base64/base128. Passwords should be randomly generated strings of bytes with no deterministic aspect to them at all.
Just use a password manager (i.e., https://github.com/zdia/gorilla/wiki) where you can generate random, uncorrelated, unique passwords for each site. Then, using the manager, you don't have to remember the individual unique passwords, it performs that function (remembering) for you. All you need to remember then is your master password to unlock the manager.
Once you've begun using a password manager, you'll quickly wonder why you didn't start using it sooner.
In Ask HN: Using a simple password, base64 encrypted for websites login?> What are the best password managers out there that do not force you to use their "cloud" for syncing between devices and are available on all major platforms?
The definition of "best" is subjective, and eventually up to your desires.
With that said, at least Password Gorilla (https://github.com/zdia/gorilla/wiki) is open source and has some built in 'sync' ability that does not _require_ any cloud service (it is manually driven, but it highlights most 'merge conflicts' for you to resolve) . It is also available on Linux, Windows, and MacOS, and while not itself available on Android there are several Android apps. (and maybe an iOS app or two) that inter-operate with the encrypted file format it uses.
In 1Password – Standalone licenses vs. new subscription servicePassword Gorilla: https://github.com/zdia/gorilla/wiki
In Ask HN: What do you use to keep distinct strong passwords?Ask HN: Password Gorilla last commit 3 years – give up on open source pwd mgr?
I've read everything I can find on HN and other sources about password managers. I was influenced by this paper "On the Security of Password Manager Database Formats" (http://www.cs.ox.ac.uk/files/6487/pwvault.pdf), it indicates PasswordSafeV3 is the only DB secure vs. Read/Write attacks (safe to store the DB in the cloud). Eventually I decided on Password Gorilla (https://github.com/zdia/gorilla) based on criteria I'll list below.
Now I realize that the github repo hasn't had a commit in 3 years, 3 years of new vulnerabilities. There is an updated (2014-10-27) version linked to their site, but this is obviously not part of the open source code in repo, so I may as well just trust the fancy new closed source products.
I'm in a quandry:
- 2nd choice: pwdsafe.org is a secure DB and source code is available on sourceforge, so theoretically I
Read the rest
can trust that malicious/crap code in there would discovered by security researchers. But it is only available for OSX from unknowns that are not open source. (https://pwsafe.org/downloads.shtml)
- 3rd choice: [KeePassX](https://github.com/keepassx/keepassx), active development, fails the standard of RW attacks researched in the paper. Open source yet inferior database is unsafe to store on G-drive, dropbox.
It looks like I have no choice but go ahead and trust an unknown software developer and hidden source code, even for the 'open source' product, might as well go with LastPass or Dashlane, which are closed source but which at least have resources and very active development and responsiveness to reported vulnerabilities. Oh and LastPass was acquired by LogMeIn so trust is even shakier.
My criteria for choosing:
- OSX and Linux
- Open Source, because I believe that it meets a higher standard of security
- Must time-out or reauthenticate after inactivity
- Support 2 Factor Authentication
- iOS client would be nice
- I'm only storing tier-two passwords.
I've used my passwordsafe v3 db with
* password gorilla https://github.com/zdia/gorilla
* pasaffe https://launchpad.net/pasaffe
* passwdsafe (android) https://play.google.com/store/apps/details?id=com.jefftharris.passwdsafe
I like a password db format which is portable to different manager implementations on different platforms, and think that passwordsafe v3 is probably a bit better than the keepass format.
(EDIT: and I don't care for integrations with browsers or anything else, they're a bad idea...)
In Even the LastPass Will Be StolenPassword Gorilla is compatible with the PasswordSafe DB v3 file format, and is not hosted on SourceForge:
https://github.com/zdia/gorilla
In KeePass – questionable securityPassword Gorilla: https://github.com/zdia/gorilla/wiki
Same code runs on Linux, MacOS, and Windows. There are also multiple Android phone apps. that work with the storage file format.
Having one application storing your passwords locally, provided you use a strong master password, is not, in and of itself, a tactically weak choice. You gain security by having local files because an attacker has to get your local file first before launching an attack. Using a "service" means that anyone (sys-admins, hackers) who can access the service can gain remote access to your password storage, from which an attack can be launched.
Using a "service" also means you have to simply take it on faith that they are storing your passwords securely. This is actually a tactically weak choice with "services", you have zero way to independently verify the se
Read the rest
cure storage they promise. Using a local open source app. means you can verify for yourself exactly how your passwords are being stored.
Password Gorilla: https://github.com/zdia/gorilla/wiki
Linux/Mac/Windows clients. Some number of Android apps. that are compatible with the underlying file format.
In Ask HN: Better, more secure password manager?Showing the 15 most recent of 40 sources. Enable JavaScript to search and browse every indexed mention.