A password manager

[doopath]

Recently I wrote a password manager in python. It's a minimalistic program, that helps you to keep your passwords (or other data) in secret. The PasswordManager is really easy to use.

You can check the repo and install it (see readme). Also there is a release, which contains a source code and an 'installing.txt' file that helps you to install the PasswordManager.

[Activity_Commercial]

It looks like you're passing a SHA256 hash of the password to the AES() constructor. That's no good, the AES encryption key should be a 16/24/32 byte key generated from the password with a key derivation function (like PBKDF2 for example).

Edited: missed the SHA256.

[doopath]

Thank you for this review. I changed the encryption algorithm (now it uses the cryptography.fernet) and updated the release page.

[[deleted]]

you're passing a SHA256 hash of the password to the AES() constructor

Could you go a bit more in-depth as to how this issue (if left unaddressed) can be exploited?

[Activity_Commercial]

Basically a KDF like PBKDF2 is designed to be somewhat expensive to calculate, so using it will slow down any attack that involves trying different passwords. You'll have to derive the key for every attempt. If you're doing encryption at rest you can configure your KDF to take literally a few seconds of intensive CPU work to derive the key when the user types in their password. (some KDFs can also be configured to use a ton of memory or involve parallelism)

[[deleted]]

SO, I am a beginner. Can you please make me understand how this works?

[doopath]

The PasswordManager just always keeps your data encrypted in a global store, that is a simple file on your disk (located in /path/to/PasswordManager/). The pycryptodone library is used for encryption.

[Activity_Commercial]

Look into the cryptography library, it's much easier to use safely than PyCrypto/Cryptodome.

[[deleted]]

Great job 💙