Show HN: Passwords Fountain – password manager interface as a PWA

Thanks for the comment! I know Bitwarden, I think it may be great alternative for "mainstream" password managers. It's whole ecosystem.

But, what I wanted is something much simpler in terms of regular usage, hosting "custom" instance, tinkering. Something which is highly optimised and does only one thing.

Do you use Bitwarden on iOS/iPadOS? How do you get it to auto fill anything? It's quite cumbersome changing Windows back and forth just to copy-paste some fields.

I would also say that storing your most valuable secrets in the same process that interacts with untrusted and potentially malicious content (ads, etc) might not be the best idea.

Agreed, I'd prefer to use all ten fingers at a keyboard on a desktop web interface than waste time with just two on a mobile device. It's just a more productive way to spend your time. Also, I don't have an unlimited data plan anymore, since why would you ever need one if you're social distancing 100% of the time? Ideally I'd switch to prepaid. Half the time I forget where my phone is, and I'm much happier for it.

First of all, thanks for valuable feedback :)

"But only 1 option (Fauna.com) as to actually store the passwords. (Or am I missing something)."

This is because I wanted to get some opinions from potential users before I'll invest more time in developing it and provide them with more options and additional tooling e.g. like CLI which I didn't even consider before (thanks again).

Even though this app looks very simple it took me a lot of time to get me to this point and release it as it is. I know that most users don't give a *t, but I did care about the code quality, no without a reason. I wanted to make it easy to tinker and personalise - you don't have to wait for me to change / add database provider or e.g. until I make it works without them.

"Nobody talks like that, if they do not want to use a password manager it is always another reason than trusting the code." I think you used "nobody" here the same way as I used "everywhere". Sometimes it's hard to evade generalisation, but I was thinking about devices with GUI.

Once more, thank you!

Yes, I meant here any other servers but Fauna. I thought it'll be obvious from the context, but I'll think about rephrasing this part. Thanks! :)

Great questions! I'll do my best to answer them:

1. You can decrypt only one password at once. It's stored in memory then. Rest of passwords remain encrypted and they are also stored in memory after being downloaded. It means that after webpage / PWA is being refreshed (or closed) you have no passwords (in any form) in the memory.

2. Passwords Fountain is using famously safe symmetric algorithm (AES-256). I think it would be hard use asymmetric approach in current architecture with staying user friendly in any way. Please note that there is no server between this app (interface) and Fauna (database) and I'm strongly against storing something needed to password decryption both in database (e.g. private key) and the browser. Becuase of that - you have to remember and protect your master key. Remember that you also have your dashboard after logging into FaunaDB account. You can verify database connections anytime you want.

3. MFA is quite serious feature and this would need also server code which I wanted to avoid as much as possible - it's making creating custom instance harder. Also - I suppose, I would have to force users to use an additional app for this purpose e.g. Google Authenticator (because I don't want to pay for any SMS service), which would make the regular usage strongly inconvenient.

4. Decryption key is stored in local variable (in memory) only for the moment it's really needed (from the moment after getting it from the user to putting it into decryption / encryption function). After this tiny time frame that aforementioned variable is getting back to its default value which is an empty string.

I hope you have now better understanding of how it works. If not - don't hesitate to ask additional questions ;)

I completely understand your point of view, but I think that at this point it's more likely to add additional db providers / options to establish app <-> db connection, than listing some niche app on fauna.com.

Agreed. I would appreciate if a demo account was provided so you could check it out without signing up to the third-party database service.

wtf is sos

Anyone in the tech industry, which is Hacker News' target audience, knows what PWA means.

And it's gaining ubiquity outside the industry as well; a search via Qwant (so not personalized) tells you that it stands for Progressive Web Application. The only other contender for the front page is Public Works Administration, which isn't remotely applicable.