Sesame - Local-first, open-source password manager
Show HN: Sesame - a local-first, open-source password manager
Sesame is a local-first, open-source password manager that keeps your passwords, 2FA codes, and recovery details together in one secure vault. It never sees your vault—everything stays on your device—and the entire app is open source. Import from 15 formats, review changes before saving, and get actionable security checkups. Available for Windows with a browser extension for Chrome, Edge, and Firefox. During the public beta, it's free to download.
Your passwords. Your computer. Sesame never sees your vault, and the whole app is open source.
- Aachen
I loosely monitor new password managers that appear with surprising regularity on F-Droid. Most have security issues that can be trivially found. It's conceptually simple software (running strings through a function before writing it to disk): nice for learning a new language, but should everyone's practice implementation seriously land in stores? So I'm skeptical of any new ones appearing from scratch, praising all their features and slick UI, with no mention of what was wrong with the incredibly diverse set of existing password manager projects. A study I read a few months ago showed that old code has fewer bugs than new code, which seems intuitive but it's nice to have actual data on it as well
Why a whole new project that needs to re-learn the gotchas that the predecessors ran into? Could any grievances have been pull requests or, worst case, a fork?
- lrvick
So you decrypt -any- password on a system with malware, and malware gets -all- the passwords. Makes life super easy for an attacker.
All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere.
To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy. Now as an attacker if I want to get the users whole database of 100 passwords I must trick them to tapping a blinking smartcard or touchid 100 times. Presumably the user would notice something is wrong, and stop. Damage control.
This is how I have been doing password management for over a decade with password store, the standard unix password manager. That tiny shell script is the -minimum- security any password manager must have.
I get that most major password managers like 1password and lastpass also get this wrong. I submit with a straight face that they have never let any capable security engineers near their products. They have a negligent design end to end and must not be replicated.
- thehamkercat
A vibe-coded password-manager? Sure! where do i sign up?
- demibabs
If you’re going to vibecode a site, at least write the copy yourself. AI text is exhausting to read.
- danielmartins
I still don’t get why password managers builders think it’s a great idea to store MFA token together with the password, totally defeating the purpose of MFA in the first place.