Hacker News new | ask | show | jobs
by gruez 2600 days ago
Why this over keepass?

Also, a quick skim of the source code shows that the program keeps the decrypted file on-disk[1]. That seems like a huge vulnerability if you don't have FDE enabled.

[1] https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...

https://github.com/nrosvall/ylva/blob/2a4afcfb3727151fa09fdd...

3 comments

I think you need FDE no matter what. e.g. Hibernation will dump your passwords to disk, even if they're only kept in in unmanaged, VirtualProtect'ed memory.
And they are doing MAC-then-Encrypt in 2019.

The author may be a great person and an excellent software developer, but they are an amateur in applied cryptography.

Use with caution.

Yeah, that looks suspect. Maybe open a GitHub issue about it?