zombiezen / sandpass

Password manager for Sandstorm

Sandpass

This project is no longer maintained.

Sandpass is a web-based password manager based on the KeePass database format that runs on Sandstorm.

Sandpass has not undergone a formal security review: use at your own risk.

Installing

Install Sandpass from the Sandstorm App Market, or grab the SPK from the releases page.

Developing

Prerequisite: Docker

git clone https://github.com/zombiezen/sandpass.git
cd sandpass

Running as a normal HTTP server:

docker build -t sandpass .
docker run --rm -p 8080:8080 sandpass

Packaging as a Sandstorm app (requires docker-spk):

docker-spk build

License

Apache 2.0. See the LICENSE file for details. Vendored libraries are released under their respective licenses.

sandpass's Issues

Periodically clear expired sessions

Expired sessions can't be used, but they stay in memory on the server. There should be a background goroutine that cleans them up.

Feature: Ability to add/remove/edit groups

Groups should be able to be added, removed, and edited. Currently they are static.

Clean up permissions

Read is implied by simply sharing the grain, so it is obsolete. nuke currently doesn't require a valid session, so it seems a bit stronger than other "write" permissions. Seems like re-keying and nuking should be a manager/admin role.

Feature: Reparent entities/groups

While editing entities and groups, they should be able to be moved.

Feature: Support desktop synchronization

It's great to see a v1.0.0 of sandpass!

I was looking into recommending SandPass to a friend. The big question I had was, can people use desktop KeePass to sync with SandPass over the web?

The answer seems to be, "Yes if SandPass supports a sync protocol that KeePass supports."

KeePass has info on desktop sync protocols here:

• http://keepass.info/help/v2/sync.html

It seems from http://keepass.info/help/v2/ioconnect.html that SandPass could export a WebDAV/HTTP URL that KeePass could use.

What do you think of supporting this? I know, "Give a mouse a cookie, he'll ask for a glass of milk" -- which is to say, I'm grateful that this app exists at all!

Delete non-empty groups

As a shortcut, I'm implementing delete as only being allowed on non-empty groups. A better implementation would be to show the user the entries they are deleting during confirmation and a count of groups, then delete it recursively. No technical reason this wouldn't work, it's just more effort.

Key file generation

During the initial grain welcome page, it would be nice to have functionality for generating a key file for brand new databases.

Session expire too quickly, persist sessions

I originally designed the sessions to last for 30 minutes or so, but Sandstorm has gotten more aggressive about shutting down grains. Fixing this requires some level of session persistence. My plan is to persist session encryption keys on the server, then store encrypted cookies with the database's computed key on the client. That way, the database's key is never persisted anywhere in the clear, and the persisted server keys can be rotated regularly. A compromise of the server keys is only valuable if you also compromise a client session token encrypted with the same key, but even then, the attacker can't gain the master password, just the computed key. The user could cycle their keyfile and still be fine.

Feature: DB-wide search for entries

There should be a simple UI for searching for entries within a database. Doesn't need to be fancy, can just match titles. Mostly so that the user doesn't have to dig through groups all the time.

Take screenshots

Before posting to App Market, I need to take screenshots of the app.

web browser password field integration

I'd like to have my browser fill in my bank password from a sandpass database.

Perhaps there's some way to use existing keepass tools that's supposed to be obvious, but I don't quite see it.

Feature: Re-encrypt databases

(Undecided for 1.0 scope)

There should be a UI for the user to be able to request a re-keying of their database. The user stories are:

• User with a no-password database decides they want to start protecting the passwords
• User's database password is compromised in some way and they want to cycle it
• Every few years the number of rounds in the database should increase in order to cope with Moore's Law
  • In fact, it would be good to warn the user of this situation (in case they're importing an existing database) and offer to rekey.

Preserve attachments

Currently, Sandpass deletes attachments that are preexisting on entries, which is unfortunate for importing and editing existing databases.

Copy old versions of entries into "Backup" group

To prevent accidental account lock-outs, it is sometimes useful to have the password manager keep old revisions of entries around. KeePassX's behavior was to create a copy of an entry in the "Backup" group every time that an entry was edited.

New UI

I'm considering do a new UI for app, but need to know some thins.
What community need in a new interface.

XSRF Protection

Even though Sandstorm provides this, it would be good to have some minimal XSRF protection for defense-in-depth.

Feature: Remove entries

Entries can be added and edited, but can't be removed. The app should expose this.

sandpass entry with no title

There is only a dot type symbol for sandpass entry which has no title. So unable to edit or delete it.

Hide write action buttons for database viewers

Clicking on one of these buttons lands the user in an unfriendly 403 page. Better to just remove the temptation.

Implement database file rotation

This is left as a TODO in storage.go, but for database integrity, Sandpass should not be overwriting the file in-place. It should write to another file and os.Rename over the original path. Perhaps we could also implement priority writes, so we could write last-access times in an ad-hoc manner, and then whichever one completely finishes writing saves.

Idea: Allow database storage to be provided by capability

(not in scope for 1.0, fuzzily defined)

There aren't well-established Sandstorm capability interfaces yet, but it would be nice to be able to use a database file from a FileDrop grain as backing for a Sandpass grain.

Save last-access time

From #23:

Perhaps we could also implement priority writes, so we could write last-access times in an ad-hoc manner, and then whichever one completely finishes writing saves.

Lower priority, but it would be nice to save last access without slowing down user-facing latency.

Maintain "continue" URL past login page

When being redirected to the index page due to missing or invalid credentials, the index page should direct the user back to the page they originally requested upon successful decryption. This permits copying/pasting grain links to specific entries, and is less annoying for long-lived sessions.

Feature: Replace database in existing grain

Allow the user to pull up a UI to delete their existing database and replace it with a new one (either imported or just from scratch).

Feature: Support KeePass2 databases

(Not in scope for 1.0)

Since I started working on the reader/writer library, it seems as though the tide has turned to make the KeePass2 XML-based database format the lingua franca format over the v1 format, especially since KeePassX no longer writes it. This isn't as pressing as it can the database format still be read and written, it does call into question some scope things:

• Should Sandpass keep using KeePass1 as its storage? If not, should it use KeePass2 or its own format (probably the former)?
• Should Sandpass have import/export functionality for other file formats? Does this matter?

Cannot delete groups

Steps to reproduce:

1. Create a new grain.
2. Enter a password and click Create.
3. Click the Misc group.
4. Click Delete.
5. Click Delete again, or whatever the confirmation button is.

Results: I'm bounced back to the password entry screen, told that my session is invalid, prompted to re-enter a password, and the group still exists.

Feature: Password Generator

There should be a minimal password generator inside the edit entry page.

Feature: Attachments

Allow uploading and downloading entry attachments.

cant get into the kdb files after exporting and extracting from backup

After i backup the grain i open it up and extract the kdb file, when i open it with keypass it gives the error that you usually get when the password is wrong, but i have no idea what to use for a password.

Icon / graphics

Hi Ross, let me know if you have any ideas. If not, I'll try to come up with some reasonable concepts/drafts sometime this week.