sylvek / leeloo

collaborative password manager

Hi there, i'm Sylvain Maucourt 👋

I'm a passionate diver 🤿 and runner 🏃‍♂️🏔🗽. I share my personal projects which are mainly smart home oriented 🏠🔌💡.

• 🏠Domotik monitores my house
• 🏰leeloo saves all my credentials
• 🔑iTracing2 helps my to find my keys

leeloo's Issues

ability to share secret with anonymous people

The main objective of this story is to share a secret with someone who doesn't have leeloo installed on his computer. We also should assure that this ephemeral grant access is base on a specific secret for a given while and a one time or more.

To do that, some ideas…

• keystores have to be sync
• we could access to leeloo by API.
• we could generate a JWT-like token containing some informations like :

• expiration time (an expiration timestamp)
• md5 of the secret
• some options like readable secret only one time
• keystore name and secret path
• the base64 signature of all this information by using GPG private key (used to store secrets)

We could share a link containing this given token (base64 encoded). By getting this url, we will check, on server side, the duration validity. After that, we could check the md5. If everything is ok, we could read the secret, check the validity of readable-one-time option (by rewrite secret, the md5 will change), rewrite the secret if needed and send back the decrypted secret.