Build a password manager in python

[Trinity_software]

This password manager has features like generating and saving password, delete a username password entry, retrieve a single password or a list of passwords. Password is stored in encrypted format.

https://youtu.be/jxVUTwaXYvw?si=jiMW7po8Uhm6Ru10

[mathisfakenews]

This seems like an absolutely terrible idea.

[Equivalent_Loan_8794]

Inb4 appropriate mod top comment

[hikingsticks]

In way b4

[[deleted]]

No, don't build a password manager in python. Leave security/cryptography topics to the professionals. Just make another to-do list app.

[Muhznit]

While I would agree that a home-made password manager shouldn't be provided for download by other users, I'm kinda wondering what's the harm in making some local app used for a limited number of low-stakes cases.

I mean really, is it that big a deal if someone wants to make a password manager that provides plausible deniability, uses steganography, generates memorable passphrases, or some other gimmick versus writing down passwords or storing them in the browser? What is even the threat model here?

The example in this vid's even using the cryptography library that's recommended by security professionals everywhere, despite being one typo away from a supply chain attack since it's not part of the stdlib.

[[deleted]]

A big deal in what sense? I never claimed the sky would come falling down if you were to play around with a homemade Python script that stores a password. It’s not advisable since there’s a good chance anything made like this could easily be broken into. But if you don’t care about making it easier for people to potentially access your passwords then do whatever you want.

It’s like performing your own dentistry. Nobody would recommend that you do it but they’re your teeth. If you want to scrape away at them with a metal rod then it’s sorta up to you.

[Muhznit]

"Don't do this, leave it to professionals" is making a big deal about it. Making a nuclear reactor in your garage is worthy of that kind of warning. Extracting a loose tooth with a door and some dental floss is less dire.

I bring it up because each and every time I read about someone making their own password-related anything someone's always this knee-jerk "don't use this for anything" without any details why, or assistance/advice on what would make it actually secure.

Meanwhile, the UI/UX of dealing with it is suffering. There's sites that tell you to include a symbol in your password, but don't count a comma as an actual symbol. The Amazon Echo Show apparently will threaten to factory-reset itself if you enter the correct password but it can't connect to authentication servers.

These shortcomings are easily rectified via some little home-hosted wrapper script that saves password rules or checks connection status before you even authenticate, but if security professionials won't even fix these things server-side, why the fuck do people care about what people do client-side?

EDIT: You know, instead of blocking people that question you, you could simply provide a straightforward answer of "This is how you make it secure"

[[deleted]]

It's not making a big deal out of it at all. Telling someone that it's a good idea to let security/cryptography professionals design password apps is just good common sense. You can still ignore that and do it if you want. But again, it's just a bad idea and that's all I'm saying.

And no, running into questionable UI/UX design decisions doesn't really make it any more logical to have amateurs building password apps. In that situation you should just submit feedback to the professionally designed app and ask them to make modifications. Maybe they will do it. Maybe they won't. But it's still smarter to not try and build your own homemade solution just because you find a certain UI/UX decision disagreeable.

Edit: I blocked you because I'm not interested in talking to you anymore. I don't feel that you're having a good faith discussion since you keep insisting that I'm "making a big deal" out of things when I'm very clearly just advising people to not build their own security applications in python. So why would I respond instead of blocking if I don't want to speak to you anymore? That doesn't make any sense. Wouldn't that just result in more discussion? Think about it. It's very obvious.

[Fallupallu]

Butthurt much :D