6

Is there a blockchain, or a smart contract designed to store user passwords?

I am using a proprietary password manager and have hundreds of passwords stored there. I am just a bit worried that the service once goes down and I lose all my passwords (including encryption keys of crypto wallets). With a blockchain-based solution, the risk of this happening should be decreased in my opinion.

1
  • 1
    With proper encryption for your needed level of security and the type of adversary you may expect to try and pwn it, it is a more viable solution than some others here state, just understand that storage might be quite expensive depending on the blockchain solution.
    – DenisM
    May 30 '18 at 18:19
3

You don't need a blockchain in order for it to be open source (and you shouldn't use blockchains to store private data, as explained by CPereez19). Instead, why not consider a local password manager such as KeePassXC or Pass? You can still rsync it or store it in a generic cloud storage solution if you want synchronization.

4
  • Do you know if any open source password manager Can run on iOS? Edit: well Pass seems to have an iOS client :-)
    – Ben2209
    May 29 '18 at 16:53
  • @Ben2209 Checkout Bitwarden it's open source and support all the platforms I can think of. Apr 16 '20 at 17:26
  • If you want to store the password in your local machine you can easily do it with a docker container. There is an extensive documentation for that here Apr 16 '20 at 17:32
  • @AbdelhakimAKODADI thanks, that’s interesting
    – Ben2209
    Apr 16 '20 at 18:18
8

The problem of storing private data on the blockchain is that everyone can see it.

  • If you encrypt the info into the blockchain, by the pseudo-random property of the blockchain you can't ensure that is 100% secure.
  • Also say that with the GDPR laws implemented now, you can't have this user's info on the blockchain, because you can't remove it if the user asks you to do it.

You can encrypt the info outside the blockchain and then put the encrypted data into it. But you still have the problem with GDPR.

Hope it helps.

2
  • Can you elaborate on "pseudo-random property of blockchain"? I don't see how my data is exposed if it is encrypted when stored on the chain.
    – Monstrum
    Sep 17 '18 at 17:56
  • If you encrypt the data before uploading it to the chain, there's no problem (GDPR only) but not security troubleshooting. Instead, if you encrypt the data after you post it on the chain, the problem is that you can only encrypt this data with other chain parameters (you can't generate a random number on a secure way). That means if someone puts effort, may be able to access the same data you are accessing to gerenare randomness to encrypt your info, and then know ho to decrypt it.
    – CPereez19
    Sep 18 '18 at 7:16
1

I think what you may want is a stateless password manager. You can choose to memorize a single or multiple master passwords, depending on your security needs, and this stateless password manager should always spit out the same deterministic password (with requested parameters of length and potentially characters). I find, just as you, that there are more points of failure with the aforementioned password managers, which keep state, encrypted or not. If your only HDD with the DB fails, what good is the encryption. Also they are quite cumbersome, especially if you travel.

The biggest risks with stateless password managers is using a weak master password, or exposing to a keylogger.

An example that is free and open-source is LessPass, available as a browser, plugin, cli, or even phone app.

2
  • 1
    Stateless password managers work great until you need to change your password somewhere. At which point you're back to storing state (even if it's just something you memorize). May 30 '18 at 8:44
  • LessPass for example has a counter system. If such a need arises, you increment the counter, and poof, new password, no need to store anything. Or at least if you do store something, it may be some metadata at worst case, and this metadata you can easily store pen & paper, or even "brute-force" with single-digit attempts.
    – DenisM
    May 30 '18 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.