wault-pw / eva Goto Github PK

The key feature of Clipperz is that no information is leaked to the third parties. None. Presence or absence of any particular user name cannot be made public - this breaks the basic tenet of secrecy.

Wault password manager is an online service that knows nothing about its users

This is false. Wault leaks usernames, since they are unique. Anyone wanting to confirm the existence of a user name just needs to create a new account with the same username, and the attempt will fail. The existence of the account with that username is now leaked!

This is why password managers must identify a user account by the (username, password) pair. Only someone knowing both will be able to know that a given account exists. If someone only knows the username, they won't be able to confirm or deny the existence of a given user account. This is very important as it gives plausible deniability - there's no way to prove you have your passwords stored on e.g. Clipperz without knowing your password. Just knowing a likely username is not enough: anyone can use that username with their own password.

Password collisions are not a problem, since users are expected to use unique passwords. If any two users have the same password, they have massively messed up already, and their security is an illusion at that point - the uniqueness of usernames only maintains this.

It is pretty good to see that the clipperz project is being continued and gets a new taint.

I would love to see the option to import my clipperz .html passwords in wault.pw. It would be OK to be only able to import the readable JSON version.

Implement validations and validator tests

Basically, the same issue that I opened in the clipperz repository :)
clipperz/password-manager#146