I would like to build an open source online password vault which allows users to securely store their passwords, like Keepass or roboform, but where a user can access their passwords through a website. The idea is that you can, Login to account Create a password vault Add passwords to the vault Can grant access to the vault to other users Authorised users can view their passwords and the passwords shared with them I will obviously encrypt my passwords but I am just curious as to how I manage/store my encryption keys. I am thinking of storing the the passwords on a restricted folder on a server which is unaccessible to the public, is this a good enough method? Should I store the encryption keys as plain text?

Thanks !

  • 1
    So like an OSS LastPass? – Brian Adkins Feb 6 '13 at 11:18
  • yes, similar to that. – rusty009 Feb 6 '13 at 11:23

For scalability, you'd pretty much have to use a database. This question is no different from any other question of how to securely store the data encryption key for a user's record and has been covered numerous times on the site. In short, there should be a key unique to either the record or user level depending on your needs. This key is then encrypted with either a public key of the user that should have access or a symmetric key derived from their password. This way, even if the entire DB was compromised, without the user's credentials (or the credentials for one of the copies of the record/user data key), it isn't possible to get at the information.

Not the answer you're looking for? Browse other questions tagged or ask your own question.