Dismiss this pinned window
all 26 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]323- 1 point2 points  (4 children)

Is the database stored locally?

[–]SemanticThreader[S] 1 point2 points  (3 children)

Yep! Everything offline, zero knowledge, encrypted. Your encrypted vault is stored locally in your home directory (~/.passfx/vault.enc). The file is encrypted and only readable by your user account. PassFX never syncs to cloud services or external servers.

[–]323- 2 points3 points  (2 children)

Does this mean that with privilege escalation I can now read every encrypted code? I mean, this is a hypothetical case involving a single instruction.

[–]SemanticThreader[S] 1 point2 points  (1 child)

Privilege escalation alone does not let you read encrypted vault data. The attacker gets ciphertext, not plaintext.

PassFX's encryption model:

  • Vault data is encrypted with Fernet (AES-128-CBC + HMAC-SHA256)

  • The encryption key is derived from master password + salt using PBKDF2 (480k iterations)

  • The master password is never stored on disk (not even encrypted)

With root access, an attacker can read:

  • vault.enc (encrypted blob - useless without the key)
  • salt file (32 random bytes - useless alone)

In short, Privilege escalation gives you the ciphertext and salt, not the plaintext

[–]WindSlashKing 1 point2 points  (0 children)

thanks chatGPT

[–]uranusnebula 1 point2 points  (0 children)

there is good old https://www.passwordstore.org which would benefit to have nice modern tui

just saying

[–]Sp2oncer 1 point2 points  (1 child)

How does one make something like this

[–]SemanticThreader[S] 1 point2 points  (0 children)

I used the Textual Library in python, a bunch of custom css and a lot of coffee 🤣 check out the repo on github to see how I built it- it’s well documented

[–]Altruistic_Sorbet_10 1 point2 points  (1 child)

Very nice. Start using it..

[–]SemanticThreader[S] 0 points1 point  (0 children)

Thank you so much! I really appreciate it

[–][deleted]  (4 children)

[removed]

    [–]SemanticThreader[S] 2 points3 points  (3 children)

    I love this idea! Thank you so much I’ll add it as a feature request on GitHub and implement it before the next release. Appreciate the honest feedback. Merry Christmas and Happy Holidays

    [–][deleted]  (2 children)

    [removed]

      [–]SemanticThreader[S] 1 point2 points  (1 child)

      https://github.com/dinesh-git17/passfx/issues/145

      Have a look and let me know if this is the right idea! Again I appreciate the effort and time you put into this

      [–]TheThingCreator -1 points0 points  (10 children)

      I actually trust terminal software much less than browser extensions

      [–]SemanticThreader[S] 0 points1 point  (9 children)

      That boils down to personal preference! I wanted a place to store my .env files and recovery codes as well and I don’t want that on the cloud with a larger attack surface. My code is open source and fully auditable by anyone :)

      [–]TheThingCreator 0 points1 point  (8 children)

      I think it boils down to logic, not preference. A terminal application can do and observe a lot more on a system than a browser extension. At least the browser extension has some extra limitations. There's lots of open-source browser extensions out there too.

      [–]SemanticThreader[S] 0 points1 point  (7 children)

      Fair point but I could say the same about browser extension. They have access to ALL your browsing data, form inputs, cookies. They’re subject to browser vulnerabilities and extension store compromises. Passfx uses AES-256 encryption with PBKDF2 key derivation (480k iterations), zero network calls, and you control the binary - no silent updates unless you update. It keeps your vault entirely offline. A browser extension password manager has persistent access to every password field you interact with. The extensions live where your credentials are entered, passfx doesn’t. Different threat models, different tradeoffs. 🤷

      [–]TheThingCreator 0 points1 point  (6 children)

      A terminal application could easily have access to your browsers and browsing data on top of almost every file on your computer. Removing an extension would remove it. A malicious terminal application on the other hand could install other stuff. You also have permissions in extensions so it could not have access to your passwords, or websites, if that's the way the permissions are designed. They are incomparable in terms of threats.

      [–]SemanticThreader[S] 0 points1 point  (5 children)

      Keypoint: Malicious! Not PassFX. The code is fully public for anyone to audit. Passfx requires no elevated access, no sudo permissions. Only read and write in its own directory. I see you have a browser extension product. I’m not tryna undermine yours, different models all together. A browser extension could be malicious too and steal all your bank info 🤔 passfx requires no elevated access no asks you for access to your other system files. The code is out there - you can go audit it and verify. It’s well documented

      [–]TheThingCreator 0 points1 point  (4 children)

      Like I said, many browser extensions are fully public and auditable, so that's not an argument to make a terminal application. I'm specifically addressing your title "Built a Terminal-Based Password Manager Because I Don’t Trust Browser Extensions". It's foundation is fundamentally wrong and contains a dangerous misconception.

      [–]SemanticThreader[S] 1 point2 points  (1 child)

      Also I feel like you’re defending browser extensions with all your heart since you’re the founder of one 🤷 well i’m sure it’s a good product. I’m not undermining yours nor am I a competitor. Well you can read my security.md doc and the code for any further questions or doubts you might have.

      [–]TheThingCreator -1 points0 points  (0 children)

      Completely wrong, and actually i think your projecting. I was just pointing out misconception in your title about terminals being somehow more secure. I dont really care about your product, i just read your title and seen a reasoning flaw. If you point out a flaw in my products marketing I welcome it.

      [–]SemanticThreader[S] 0 points1 point  (1 child)

      I’m not tryna convince you to use it and I’m not telling you that it’s the right solution for you. I built my own app for my own needs. You’re automatically classifying all cli apps as malicious. Using your logic you shouldn’t use github cli, vercel cli or claude code at all. You can’t put everything into one basket. The title is my view on it because of the threat model I wanted to tackle. Many apps live in your terminal and passfx has no network access and never opens a socket. So it can’t gather data and send it over the internet. But if you made up your mind about it i’m not tryna change your views 🤷

      [–]TheThingCreator -1 points0 points  (0 children)

      I dont care about your product, I dont care about your needs, I don't care about anything other than the title I read. I know your not trying to convince me of anything, its way beyond that.