jarm0

I was using LastPass at first. I even paid them some money to have support on mobile. I didn't like LastPass because their UI was just really ugly and I saw some security problems being discovered. Switched to mitro since it was free and UI wasn't bad. Worked great, but unfortunately they ceased their service.

I got fed up with switching these services so often and didn't want to do the same thing yet again (and can't remember what alternatives existed back then).

Since security has been my point of interest for years I decided to look into building my own so that I would actually know for sure (as long as cryptography itself is secure) about all the parts - how secrets are encrypted, how they're stored and how they're synced. It was spring 2015 when I wrote my first password manager in Ruby. It worked great, but the problem was that I didn't want to install Ruby and its gems on every system where I wanted to access my secrets so I went with Go and this is where secrets-cli (https://github.com/jarmo/secrets-cli/) grew up. After that I decided that I'd also want to access secrets via browser and created secrets-web (https://github.com/jarmo/secrets-web/). Web and CLI versions are interoperable between each-other so that you can use either one of them or both at the same time.

This is a really simple and definitely a better solution than not using any password manager at all (if we leave out possible government/Google issues, which I personally would definitely not leave out).

But yeah, as already mentioned - it breaks the privacy and security principles. I would recommend you try anything else, which is actually meant for storing passwords/secrets and when switching, then change all your passwords :)

That's a good principle in theory, but how do you know that using any 3rd party password manager is any better? There has been plenty of security problems with all of the major providers as far as I'm concerned.

At least with all these DIY password managers which are open-source you can see all the code, which is not true for any 3rd party custom made solutions.

Also, one of the reasons why I went with libsodium as an encryption solution is the exact same reason - I'm not a cryptograper and libsodium offers an easy and fool-proof API to not mess things up accidentally. This is not true for many other (popular) cryptography solutions.

Thanks!

This project has it all except autofill. Okay, to be really honest then on mobile you need to access secrets via browser (UI is responsive though) and there's no separate app for that.

Autofill is not supported and I don't plan to add it on purpose. It's even written in the core project (https://github.com/jarmo/secrets) README:

"does not auto-fill any passwords anywhere (you don't want that anyway) - it's up to you how you will fill your passwords;".

There's one link to an article regarding possible problems with autofills https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-u...

When it comes to mobile apps then I don't find them that important to add yet another possible attack vector (also mentioned in the README) since it's pretty easy to copy-paste whatever is needed.