B.lock: a blockchain-powered password manager | Hacker News Reader

B.lock: a blockchain-powered password manager

github.com

18 pointsblockproject24 comments

> b.lock saves the encrypted passwords/secret notes on the Nebulas blockchain

What possible benefit could there be to storing my secrets in a public blockchain rather than private storage? I only see downsides.

The readme mention 2 'problems' with existing solutions:

"Single point of failure: if the server/database goes down, there goes your passwords"

This is not a reason to use a blockchain - it's a reason to use a highly available system.

"Trust issue: can you really trust that these closed-source softwares will not just read your passwords?"

This is not a reason to use a blockchain - it's a reason to use OSS.

I'm not seeing the benefit either. If your credentials are stored under strong encryption, then it's the encryption that's providing a confidentiality and integrity assurance, wholly independent of blockchain or any other storage solution.

> Private storage

Easier to store a private key that gives access to a blockchain datastore than to store a decryption key + private storage file that would need to be replicated across all systems you want password access.

> HA system

That's a hosted solution, so it isn't completely trustless.

> closed-source softwares will not just read your passwords

I agree that this has nothing to do with a blockchain.

> That's a hosted solution, so it isn't completely trustless

If the secrets are encrypted, I don't see how there is any more of a trust issue with a hosted storage system than with a public blockchain?

The fact that the data is encrypted means that it can literally be stored anywhere. You can throw it in a local file or in Dropbox/Google Drive/iCloud.

The trust issue also doesn’t matter cause if the encryption is right, then third parties wouldn’t be able to read your data even if they wanted to.

> What possible benefit could there be to storing my secrets in a public blockchain rather than private storage? I only see downsides.

This is why you are poor. You wrap this in an ICO and easily make a million dollars.

Centralized systems aren't vulnerable just because of uptime. They can also terminate your access at will, like if you forget to pay a bill, or if some government actor comes knocking on their door.

And spaffing your encrypted secrets to the wind allows anyone to have a go at cracking your keychain.

YEah its "universally available" but so is having a few git repos, or god forbid one's own server or two.

Blockchain has very limited use outside of a system that has lots of money and requires zero trust immutable log of things, which can tolerate very high latency and long period of inconsistency (ie a trading platform.)

That's discussed on the linked page (under the 'Why blockchain?' heading).

My post literally questions the 2 'reasons' given in the linked page.

That should be the entirety of the web page.

A blockchain is a database with virtue. This solution provides social acceptance.

The "blockchain" is an extremely inefficient self validating database. There is no virtue.

https://twitter.com/dgwbirch/status/1010606861740101632

> b.lock uses your Nebulas private key (in other words, the master key) to encrypt your passwords and secret notes, using the AES-256 encryption algorithm.

Without digging any further, this is one of the scariest parts. Maybe they say AES because their marketing is aimed at ignorant people, for which a bare "AES" still sounds good. But if they are thinking AES, then I'm afraid how insecure their chosen mode of operation (and implementation thereof) might be.

Not too afraid though. The whole premise is bogus, there are less wasteful ways to manage passwords.

I would hope they are using some form of authenticated encryption, and talk about AES to keep it simple... but given the pointlessness of using a blockahain for this, maybe not.

Also, they explicitly say they are using the master key - they should really be using a DEK.

It is entertaining that the "Why blockchain" section doesn't give a single reason why a blockchain-based solution would be a good choice.

It's a common tactic in blockchain projects. They cite legitimate problems, but fail to make a case as to why existing solutions are inadequate and specifically how blockchain's properties are a good way to meet those needs.

Yep, it gives 2 entirely unconvincing reasons why using existing solutions have issues.

So they're using AES in CTR mode for encryption. They encrypt both key (website + login) and value (password) using the same key (wallet private key) and counter (1). [1] Which means you can just bruteforce popular domain names, xor encryptedPass ^ encryptedKey ^ domainName, and get first bytes of the password (depending on domain name length), just by going through some recent TXs at [2].

[1] https://github.com/BlockProject/b-lock/blob/8a19e0b404a8afee...

[2] https://explorer.nebulas.io/#/address/n1qmQeLTUU6fPJMs1uwTad...

That's exactly the kind of things I was afraid of when they stated that they said "using the AES-256 encryption algorithm."

Well, hopefully this will get better under proper scrutiny.

> using the same key (wallet private key)

This is a bad idea. They should really be using a DEK.

Imagine waking up in the morning and thinking, "This world needs another blockchain."

Dupe of? https://news.ycombinator.com/item?id=17387453

Reply on news.ycombinator.com