Show HN: Sesame - a local-first, open-source password manager
I have been working on Sesame, an open-source password manager that keeps your vault local by default. You don't need an account to create or use a vault, and the hosted service never receives the vault itself. It's still early software and the independent security review isn't finished yet, so I am mainly interested in feedback, testing, and people looking through the code. (Linux support is yet to be released on v0.1.2, but currently is in the works.)
Discussion Highlights (17 comments)
ramon156
how does this compare to vaultwarden + bitwarden? my only concern there is that VW can throw self-host support out the door whenever they like. not that they'd have a reason to
gregable
How does it compare to KeePassXC?
konaraddi
Does it purge passwords from memory on vault lock?
arlattimore
I like that this could be self hosted. I don't have anything against the big password managers (I use and pay for one), but they are a massive target for hackers for obvious reasons. If everyone could self host their own vault on a personal domain, the reward for hackers is much more difficult to get access to.
cyberax
I don't see the support for passkeys listed anywhere?
majorchord
No offense but you might want to consider a different styling for the app/site because IMO this one screams "Claude vibe-code style".
vladkens
Again Tauri. How then it different from Bitwarden? Desktop != Web
oscarcp
How does it compare to a local deploy of PSONO?
thehamkercat
A vibe-coded password-manager? Sure! where do i sign up?
danielmartins
I still don’t get why password managers builders think it’s a great idea to store MFA token together with the password, totally defeating the purpose of MFA in the first place.
Aachen
I loosely monitor new password managers that appear with surprising regularity on F-Droid. Most have security issues that can be trivially found. It's conceptually simple software (running strings through a function before writing it to disk): nice for learning a new language, but should everyone's practice implementation seriously land in stores? So I'm skeptical of any new ones appearing from scratch, praising all their features and slick UI, with no mention of what was wrong with the incredibly diverse set of existing password manager projects. A study I read a few months ago showed that old code has fewer bugs than new code, which seems intuitive but it's nice to have actual data on it as well Why a whole new project that needs to re-learn the gotchas that the predecessors ran into? Could any grievances have been pull requests or, worst case, a fork?
lrvick
So you decrypt -any- password on a system with malware, and malware gets -all- the passwords. Makes life super easy for an attacker. All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere. To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy. Now as an attacker if I want to get the users whole database of 100 passwords I must trick them to tapping a blinking smartcard or touchid 100 times. Presumably the user would notice something is wrong, and stop. Damage control. This is how I have been doing password management for over a decade with password store, the standard unix password manager. That tiny shell script is the -minimum- security any password manager must have. I get that most major password managers like 1password and lastpass also get this wrong. I submit with a straight face that they have never let any capable security engineers near their products. They have a negligent design end to end and must not be replicated.
demibabs
If you’re going to vibecode a site, at least write the copy yourself. AI text is exhausting to read.
globalnode
ive got my own pwd file using a short shell script in bashrc that uses nano, gpg and /dev/shm to keep things in memory (hopefully). works great, is minimalist and there are no hidden surprises.
2legit2quit
This sounds an awful lot like PasswordSafe[0] in a different dress. Does it provide any features that set it apart? 0 - https://www.pwsafe.org/relatedprojects.shtml
senectus1
you got to pay 10 euro a year to self host?
valenterry
I wish there was a password manager with a different focus. In the way where there would be a server (selfhosted) that has the passwords and is well protected. Then, on the server, I can configure access to the secrets on my clients and — and that is important — restrict the number of secrets that can be accessed per time. And on each client I want to be told if secrets got accessed by another client. Because, optimally I would use passkeys and other means of authentication, except for initial auth. But if my client gets compromised I don't want it to be able to access and exfiltrate all secrets at once. That is basically the worst case scenario. I don't understand why it's not common in password managers to have different categories of how important a secret is and better control/transparency to detect compromised clients and contain the impact.