NewsLab
Oct 27 20:47 UTC

Show HN: Cryptex Vault – A password manager designed to outlive its creator (cryptex-vault.com)

3 points|by Bl4cksmith||6 comments|Read full story on cryptex-vault.com
Hello everyone!

About four years ago, a password manager I've used and depended on has been acquired and soon after, it was shut down. If anyone remembers MYKI, it was a password manager that stood out at the time. It didn't require an email address and a password for registration and it synchronized credentials peer-to-peer. It was quite handy so a couple of my friends and I got hooked, and were using it up until the last day it was online.

The thing was, I didn't want to change password managers to other options available at the time, none felt right - I wanted to stay.. So I did what any sensible engineer would do 4 years ago and I wrote my own.

I moved all my credentials there as soon as I had a first version ready. It was ugly (God knows I had UI/UX skills to learn), but it worked.

Soon after, the same friends that were using MYKI switched over to using Cryptex Vault. I get why, we had the same P2P synchronization across devices, it was simple and didn't try to be the most-feature complete application out there - it did the job. That was an exciting moment. So exciting, in fact, that I've posted to HN to tell people about it. At the time, I had a weird thing for decentralization so I called it a "Fully Decentralized Password Manager".

Three years go by, I keep maintaining the project, with no real intention of proper marketing or polishing. At one point I checked the usage and figured out that a handful of people (and their families) were still using Cryptex Vault as their password manager.

Three months ago, I left my comfy job as lead software engineer at a local company to dedicate time to a company I called Cryptex Industries. Polished Cryptex Vault, cleaned it up, made it open source, started providing Docker images for self-hosting and included some of the features I've only used internally (ssh-agents). That way Cryptex Industries need not remain operational for users to have a path to continued use!

To make the project commercially viable, I started offering managed services through the Online Services plan. By using Online Services you remove the operational burden of self-hosting and infrastructure maintenance from yourself while still getting the same benefits: Managed backup storage, synchronization between devices, sharing, ssh-agents, device management. It is convenience, not access to core features. The core application is free and you can use it with no subscriptions of any kind, whatsoever.

It's P2P synchronized, with industry-standard crypto choices including post-quantum primitives for synchronization - https://www.cryptex-vault.com/docs/cryptography It has importers for popular password managers, along with autofill for chromium browsers (firefox is a todo, yell and I'll get on it). As for the platforms, there is a web app, an android application and an ssh-agent for linux (will put it up on AUR when they open up registrations again).

Feel free to try it out (there is a 14-day trial for managed services!), self-host it or break it.

I would appreciate your thoughts on this and I wish you a nice friday!

Comments (6)

6 shown
  1. 1. herczegzsolt||context
    My primary issue with a new password manager is always trust.

    Are there any plans to review the source code independently, or do something similar to prove it's end-to-end security?

  2. 2. Bl4cksmith||context
    I understand you and I feel the same way. I am currently working with a couple of people that are well-versed in this space so that we can get more eyes, and a proper security audit for the whole codebase in the following year.

    You can follow progress here: https://www.cryptex-vault.com/security

  3. 3. Arongbyeol||context
    sorry.. i'm still learning so maybe dumb question if i save a new password on my pc at home and turn it off, how can i see it on my phone when i'm outside..?
  4. 4. Bl4cksmith||context
    Not a bad question at all, no worries.

    When you save your password on your PC, the password is saved into an encrypted store that is physically on that PC, and to get it to your phone you need to have the application (be it web or native android) open and your vault unlocked so that the two can synchronize.

    What I do is to prepare the phone vault by unlocking it and synchronizing right away as I make changes if something is critical.

    That is the trade-off when it comes to convenience as compared to something like BitWarden, for example. There the credentials are stored in a centralized database that your PC or phone can reach independently of each other.

    EDIT: More details here: https://www.cryptex-vault.com/docs/synchronization

  5. 5. bookmarkcanvas||context
    have you thought about who would handle live support?
  6. 6. Bl4cksmith||context
    Hi! Am very responsive over email (support@cryptex-vault.com) and GitHub Discussions (https://github.com/CryptexIndustries/vault-web/discussions).

    If there's anything you need help with, just let me know - I'll do my best to help in any way I can :)