Comment by geofft | Hacker News Reader

Comment by geofft | Hacker News Reader

Parent Full thread

> Someone unironically said in this thread they "never trusted LastPass" (implying this is safer somehow?!) but technologically you don't specifically need to.

There's something to be said about perception. A big corporation making money off a centralized service that uses the money to employ people to get things right? Seems sketchy. Some people on GitHub with a Chrome extension that can read and write all data on every web page you visit and intentionally syncs your passwords with ... AES-CTR with no integrity protection??? please tell me I'm misreading this ... to some random altcoin? Sounds great, these people must have my best interests in mind, hack the planet, fight the power, &c. &c.

The question is, how do we change these perceptions?

> AES-CTR with no integrity protection???

Seems to be the case, with non-random nonces... If I read the documentation of the used library correctly, it starts the counter always with 1 by default. Game over?

Oh my gosh are they doing nonce reuse for a password manager? Amazing. Better not change your passwords ever!

And never have one of your passwords leaked.

Yes we need to change the encryption algorithm. This is just an proof-of-concept that is still being worked on.

1. Please say that before people use it. Nothing at https://github.com/BlockProject/b-lock or https://blockproject.io/ says "proof of concept" or "you shouldn't use this yet."

2. You haven't proved the concept if you're not handling your key material right - among other things, if I'm still reading right, it looks like you're using the (asymmetric) wallet private key as the (symmetric) encryption key for passwords? Is this in any way safe? (Traditionally, the overwhelming consensus of the cryptography community is no.) If you need to generate new keys and unique nonces and verify IVs, you need to figure out how and where you're storing a key before you've successfully proved the concept.

We have improved our encryption algorithm, please review it at our more recent post: https://news.ycombinator.com/item?id=17394807 reply

Reply on news.ycombinator.com