Hacker News new | past | comments | ask | show | jobs | submit login

With files and reasonably secure passwords you are probably using copy-paste to move the passwords. Keeping sensitive information on clipboard is a risk. Not just because of malware, you might also accidentally paste the information to wrong place.

Browser plugins can have issues, but they also improve security by only allowing you the enter the password when legitimate domain is requesting it. With copy-paste approach you might enter the password to some phishing site (obviously browser plugins can introduce their own security issues, so this is a trade-off).

Dedicated applications may take steps to protect the sensitive information in the memory while a normal text editor probably does not do that. With AES encrypted file you would need to think the workflow to make sure the unencrypted contents is not exposed for example via temporary files. Dedicated appliation can also automatically lock the contents after some timeout, with text files you need to take care this manually.




Would definitely not use the clipboard. Might use stdout of a quick exe run, or might use native OS keyboard messages... but that's a different concern. My question here was just about the contents themselves and less about the handling. Maybe, as the author here did, I can just run a server conforming to bitwarden's API.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: