There is link to Figma designs in the README. You can check there how it works without creating Fauna account, whole application flow is presented there ;)
16 karma · joined May 13, 2020
1. You can decrypt only one password at once. It's stored in memory then. Rest of passwords remain encrypted and they are also stored in memory after being downloaded. It means that after webpage / PWA is being refreshed (or closed) you have no passwords (in any form) in the memory.
2. Passwords Fountain is using famously safe symmetric algorithm (AES-256). I think it would be hard use asymmetric approach in current architecture with staying user friendly in any way. Please note that there is no server between this app (interface) and Fauna (database) and I'm strongly against storing something needed to password decryption both in database (e.g. private key) and the browser. Becuase of that - you have to remember and protect your master key. Remember that you also have your dashboard after logging into FaunaDB account. You can verify database connections anytime you want.
3. MFA is quite serious feature and this would need also server code which I wanted to avoid as much as possible - it's making creating custom instance harder. Also - I suppose, I would have to force users to use an additional app for this purpose e.g. Google Authenticator (because I don't want to pay for any SMS service), which would make the regular usage strongly inconvenient.
4. Decryption key is stored in local variable (in memory) only for the moment it's really needed (from the moment after getting it from the user to putting it into decryption / encryption function). After this tiny time frame that aforementioned variable is getting back to its default value which is an empty string.
I hope you have now better understanding of how it works. If not - don't hesitate to ask additional questions ;)
But, what I wanted is something much simpler in terms of regular usage, hosting "custom" instance, tinkering. Something which is highly optimised and does only one thing.
"But only 1 option (Fauna.com) as to actually store the passwords. (Or am I missing something)."
This is because I wanted to get some opinions from potential users before I'll invest more time in developing it and provide them with more options and additional tooling e.g. like CLI which I didn't even consider before (thanks again).
Even though this app looks very simple it took me a lot of time to get me to this point and release it as it is. I know that most users don't give a *t, but I did care about the code quality, no without a reason. I wanted to make it easy to tinker and personalise - you don't have to wait for me to change / add database provider or e.g. until I make it works without them.
"Nobody talks like that, if they do not want to use a password manager it is always another reason than trusting the code." I think you used "nobody" here the same way as I used "everywhere". Sometimes it's hard to evade generalisation, but I was thinking about devices with GUI.
Once more, thank you!
It's basically PWA app written in Preact with the help of other micro-sized libs like goober.js (CSS in JS).
Whole codebase can be found here https://github.com/kolodziejczakM/passwords-fountain.
If you're willing to check how it works, then official instance is here https://passwords-fountain.com/, but you can easily create your own, even free of charge (you need only static site hosting).
I hope you'll like it and I'm opened to your feedback.