7

Is there a blockchain, or a smart contract designed to store user passwords?

I am using a proprietary password manager and have hundreds of passwords stored there. I am just a bit worried that the service once goes down and I lose all my passwords (including encryption keys of crypto wallets). With a blockchain-based solution, the risk of this happening should be decreased in my opinion.

Improve this question
1
  • 1
    With proper encryption for your needed level of security and the type of adversary you may expect to try and pwn it, it is a more viable solution than some others here state, just understand that storage might be quite expensive depending on the blockchain solution.
    – DenisM
    May 30, 2018 at 18:19

4 Answers 4

Reset to default
4

You don't need a blockchain in order for it to be open source (and you shouldn't use blockchains to store private data, as explained by CPereez19). Instead, why not consider a local password manager such as KeePassXC or Pass? You can still rsync it or store it in a generic cloud storage solution if you want synchronization.

Improve this answer
4
  • Do you know if any open source password manager Can run on iOS? Edit: well Pass seems to have an iOS client :-)
    – Ben2209
    May 29, 2018 at 16:53
  • @Ben2209 Checkout Bitwarden it's open source and support all the platforms I can think of.
    – Abdelhakim AKODADI
    Apr 16, 2020 at 17:26
  • If you want to store the password in your local machine you can easily do it with a docker container. There is an extensive documentation for that here
    – Abdelhakim AKODADI
    Apr 16, 2020 at 17:32
  • @AbdelhakimAKODADI thanks, that’s interesting
    – Ben2209
    Apr 16, 2020 at 18:18
10

The problem of storing private data on the blockchain is that everyone can see it.

  • If you encrypt the info into the blockchain, by the pseudo-random property of the blockchain you can't ensure that is 100% secure.
  • Also say that with the GDPR laws implemented now, you can't have this user's info on the blockchain, because you can't remove it if the user asks you to do it.

You can encrypt the info outside the blockchain and then put the encrypted data into it. But you still have the problem with GDPR.

Hope it helps.

Improve this answer
3
  • Can you elaborate on "pseudo-random property of blockchain"? I don't see how my data is exposed if it is encrypted when stored on the chain.
    – Monstrum
    Sep 17, 2018 at 17:56
  • If you encrypt the data before uploading it to the chain, there's no problem (GDPR only) but not security troubleshooting. Instead, if you encrypt the data after you post it on the chain, the problem is that you can only encrypt this data with other chain parameters (you can't generate a random number on a secure way). That means if someone puts effort, may be able to access the same data you are accessing to gerenare randomness to encrypt your info, and then know ho to decrypt it.
    – CPereez19
    Sep 18, 2018 at 7:16
  • Well, you can't delete it per se, but you can set it to null (or whatever), which would be the same. Also, if you encrypt the information before, that means that you should store somewhere offline a private/public key pair, which basically means that your app is not 100% descentralized
    – redigaffi
    Dec 24, 2021 at 8:43
1

I think what you may want is a stateless password manager. You can choose to memorize a single or multiple master passwords, depending on your security needs, and this stateless password manager should always spit out the same deterministic password (with requested parameters of length and potentially characters). I find, just as you, that there are more points of failure with the aforementioned password managers, which keep state, encrypted or not. If your only HDD with the DB fails, what good is the encryption. Also they are quite cumbersome, especially if you travel.

The biggest risks with stateless password managers is using a weak master password, or exposing to a keylogger.

An example that is free and open-source is LessPass, available as a browser, plugin, cli, or even phone app.

Improve this answer
2
  • 1
    Stateless password managers work great until you need to change your password somewhere. At which point you're back to storing state (even if it's just something you memorize).
    – Teo Klestrup Röijezon
    May 30, 2018 at 8:44
  • LessPass for example has a counter system. If such a need arises, you increment the counter, and poof, new password, no need to store anything. Or at least if you do store something, it may be some metadata at worst case, and this metadata you can easily store pen & paper, or even "brute-force" with single-digit attempts.
    – DenisM
    May 30, 2018 at 17:44
0

Has anyone seen this blockchain based password manager.

https://medium.com/coinmonks/b-lock-the-blockchain-powered-password-manager-d7ec94524af9

Improve this answer
1
  • 1
    The link to chrome store returns 404, their github repo hasn't been updated in 4 years.
    – Ismael ♦
    Mar 4, 2022 at 4:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.