FRESH

Hacker News

Show HN: A password system with no database, no sync, and nothing to breach

12 points by KevinChasse

by SahAssar

0 subcomment

This relies on the browser, and it's not even setting relevant browser security features like CSP. It also loads scripts from multiple domains like umami.is and esm.sh, includes google fonts. It uses vercel for hosting.
So you are trusting at the very least the author, umami, esm.sh (including the authors of all of those packages) and vercel.
This is not how you code a security-sensitive app.
There also is a database, it's just indexdb/localStorage in your browser.
It's an old idea to use in browser static pages to encrypt data, this solves none of the problems with the idea, but is just glitzy AI-written marketing copy.

by collingreen

1 subcomments

I made one of these once and stopped using it for some of the same reasons folks have in the comments:
- losing the master is catastrophic - sign ins with dumb password rules meant I had to sync metadata - a bad actor knowing my resulting password, their site, my username, and potentially my password version meant in theory they could brute force offline and see if they could infer my master - I had to do silly things to use my passwords on not-my-device - getting my password on not-my-device felt extremely dangerous

0 subcomment

by commandersaki

1 subcomments

E2EE with a high entropy key as is the case with 1P will save you in the case of a compromise of your vaults stored externally and don't have weird limitations on what your passwords can be.
Also sync'ing is handy for multi-device setup.

by rustyhancock

1 subcomments

I've always wondered if it's stateless how do I rotate a password? Either due to leaking or just periodically.
It seems particularly important since this doesn't defend against compromised local environment.

by KevinChasse

0 subcomment

FYI: Bastion assumes a trusted local execution environment and a strong master secret. It does not defend against a compromised OS or browser runtime. The system trades convenience (sync, cloud recovery) for deterministic, stateless, and cryptographically verifiable password generation.

by stavros

1 subcomments

This is a lot of cryptography, but how is it better than the hundred previous attempts, that simply hashed the input?

by stephenr

1 subcomments

I was going to make a comment about the irony of a system that seemingly forces users to use generated passwords that also claims "we don't know your password" but then I saw that it's apparently AI coded.
Yeah good luck with that. Authentication code needs AI generated code like a cow needs burger sauce and brioche buns.