zdia

gorilla

Tcl2010–2020

zdia / gorilla

gorilla

Password Gorilla manages passwords

Security & Privacy

Explore on GitHub Read Hacker News discussions

4Distinct people

40Mentions

1Explicit recommenders

427GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Password Gorilla manages passwords

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

Don't use the built in password storage of any browser. Doing so leaves you vulernable to bugs such as this one: http://forum.avast.com/index.php?topic=25044.0;wap2. I.e., if a…

pwg used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 11:19:25 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year40 dated mentions

Observed mentions: 2010-09-15 19:13:14 UTC to 2020-06-23 18:43:46 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2010	2010-01-01 00:00:00 UTC	2011-01-01 00:00:00 UTC	5	0	5
2011	2011-01-01 00:00:00 UTC	2012-01-01 00:00:00 UTC	14	1	13
2012	2012-01-01 00:00:00 UTC	2013-01-01 00:00:00 UTC	2	0	2
2013	2013-01-01 00:00:00 UTC	2014-01-01 00:00:00 UTC	0	0	0
2014	2014-01-01 00:00:00 UTC	2015-01-01 00:00:00 UTC	6	0	6
2015	2015-01-01 00:00:00 UTC	2016-01-01 00:00:00 UTC	2	0	2
2016	2016-01-01 00:00:00 UTC	2017-01-01 00:00:00 UTC	5	1	4
2017	2017-01-01 00:00:00 UTC	2018-01-01 00:00:00 UTC	2	0	2
2018	2018-01-01 00:00:00 UTC	2019-01-01 00:00:00 UTC	2	0	2
2019	2019-01-01 00:00:00 UTC	2020-01-01 00:00:00 UTC	1	0	1
2020	2020-01-01 00:00:00 UTC	2021-01-01 00:00:00 UTC	1	0	1

What Hacker News says

5 sources

pwg·Dec 14, 2016

Wait? You mean you answer those questions with real data? My answers to those (when required) always look like this: > “What was the name of your first pet?” JBK?a0ly(VE3E-|-@BADZFPS<1Fh$X23 Where the "goop" is generated, and remembered, by my password manager (https://github.com/zdia/gorilla/wiki).

In New NIST password guidelines: don't require character types or rotation

pwg·Dec 8, 2016

What you use as an example input is not the point. Your entire scheme is insecure. It is a fully deterministic scheme from input to output, and reversible as well given your suggestion of base64/base128. Passwords should be randomly generated strings of bytes with no deterministic aspect to them at all. Just use a password manager (i.e., https://github.com/zdia/gorilla/wiki) where you can generate random, uncorrelated, unique passwords for each site. Then, using the manager, you don't have to remember the individual unique passwords, it performs that function (remembering) for you. All you need to remember then is your master password to unlock the manager. Once you've begun using a password manager, you'll quickly wonder why you didn't start using it sooner.

In Ask HN: Using a simple password, base64 encrypted for websites login?

pwg·Aug 28, 2016

> What are the best password managers out there that do not force you to use their "cloud" for syncing between devices and are available on all major platforms? The definition of "best" is subjective, and eventually up to your desires. With that said, at least Password Gorilla (https://github.com/zdia/gorilla/wiki) is open source and has some built in 'sync' ability that does not _require_ any cloud service (it is manually driven, but it highlights most 'merge conflicts' for you to resolve) . It is also available on Linux, Windows, and MacOS, and while not itself available on Android there are several Android apps. (and maybe an iOS app or two) that inter-operate with the encrypted file format it uses.

In 1Password – Standalone licenses vs. new subscription service

pwg·Jul 21, 2016

Password Gorilla: https://github.com/zdia/gorilla/wiki

In Ask HN: What do you use to keep distinct strong passwords?

banku_brougham·Mar 29, 2016Submission

Ask HN: Password Gorilla last commit 3 years – give up on open source pwd mgr?

I've read everything I can find on HN and other sources about password managers. I was influenced by this paper "On the Security of Password Manager Database Formats" (http://www.cs.ox.ac.uk/files/6487/pwvault.pdf), it indicates PasswordSafeV3 is the only DB secure vs. Read/Write attacks (safe to store the DB in the cloud). Eventually I decided on Password Gorilla (https://github.com/zdia/gorilla) based on criteria I'll list below. Now I realize that the github repo hasn't had a commit in 3 years, 3 years of new vulnerabilities. There is an updated (2014-10-27) version linked to their site, but this is obviously not part of the open source code in repo, so I may as well just trust the fancy new closed source products. I'm in a quandry: - 2nd choice: pwdsafe.org is a secure DB and source code is available on sourceforge, so theoretically I

Read the rest

can trust that malicious/crap code in there would discovered by security researchers. But it is only available for OSX from unknowns that are not open source. (https://pwsafe.org/downloads.shtml) - 3rd choice: [KeePassX](https://github.com/keepassx/keepassx), active development, fails the standard of RW attacks researched in the paper. Open source yet inferior database is unsafe to store on G-drive, dropbox. It looks like I have no choice but go ahead and trust an unknown software developer and hidden source code, even for the 'open source' product, might as well go with LastPass or Dashlane, which are closed source but which at least have resources and very active development and responsiveness to reported vulnerabilities. Oh and LastPass was acquired by LogMeIn so trust is even shakier. My criteria for choosing: - OSX and Linux - Open Source, because I believe that it meets a higher standard of security - Must time-out or reauthenticate after inactivity - Support 2 Factor Authentication - iOS client would be nice - I'm only storing tier-two passwords.

20 points · Open discussion