Simple Vaultless Passwords in the Browser

novault.pw

2 points·levidurfee··5 comments

NoVault is a password utility that derives new unique passwords on the fly. Your team can use the same password for different resources. A resource can be a domain (example.com) or any string value. This combination allows you to create secure passwords that aren't centrally stored. NoVault means no attack surface. Everything happens in your browser, nothing is sent to any server.

Code: https://github.com/levidurfee/novault

a little confused on what this is and how its expected to work in practice...a blurb would be nice

I guess you always use same password and for each resource it generates different passwords. But the same password/resource combination always results in same password. Not sure about security issues, as similar tools were posted and discussed before.

I got the idea from https://github.com/cloudflare/gokey

> gokey is a password manager, which does not require a password vault. Instead of storing your passwords in a vault it derives your password on the fly from your master password and supplied realm string (for example, resource URL). This way you do not have to manage, backup or sync your password vault (or trust its management to a third party) as your passwords are available immediately anywhere.

Instead of having to install a binary on your computer I thought it would be nice to have a web-based utility. Everything is done in your browser, so nothing is sent to any other servers to process the request.

I'm definitely open to criticism, feedback, suggestions, etc..

Reply on news.ycombinator.com