0

I want to build a simple password manager for desktop whose sole purpose is to store the passwords that can be read by the user as and when required.

I am not considering any fancy features such as autofill, cloud storage, password sharing etc.

Its purpose is to just store the passwords. What are the guidelines to build such secure password manager?

Improve this question
10
  • 6
    If you're actually planning to use this, then the best guideline is: don't. People who roll their own critical security software nearly always make mistakes that leave them vulnerable. Get yourself a reputable commercial or open-source password manager. If you're just doing it as a programming exercise to learn about writing secure software then by all means go ahead.
    – Mike Scott
    Dec 18, 2014 at 8:21
  • 2
    @Curious: Because a password manager is never simple.
    – AviD ♦
    Dec 18, 2014 at 8:43
  • 1
    Download and read about the ones that already exists, like KeepPass or Password Safe
    – user13695
    Dec 18, 2014 at 9:22
  • 1
    @Curious Keepass is also open source, maybe download the source code and have a read to get an idea of the work required to build a basic password manager
    – JMK
    Dec 18, 2014 at 11:05
  • 1
    There is no such thing as a "simple" or "basic" password manager. Unless it is broken, and worthless...
    – AviD ♦
    Dec 18, 2014 at 11:27

1 Answer 1

Reset to default
5

I agree with Mike Scott's comment that it's best to use something which is already open-source which has gone through all the research and so on. If your doing the project for learning and personal usage then start off with basics such as:

  • If you support clipboard don't forget to clear it during application been closed or after a set time period.
  • Don't leave text in memory after it's usage
  • Do good amount of research into encryption for your database and enforce a good password policy
  • Support keyfiles for higher level of security
  • Don't store any confidential information as plain text on disk
  • Don't support any network related APIs or if you do make sure you validate all your buffers to avoid any remote buffer overflows.

You could go alot more into malware targeting your software using APIs such as FindWindow to read the strings out of your application and code injection using CreateRemoteThread but I'm not too sure of how complexity you want to secure the password from been stolen via malware.

I'd recommend you look into the code of an reputable password manager which is open-source as they will of done the above and more.

I know this list doesn't cover everything but I hope it's a good starting point for you.

Improve this answer
1
  • 3
    Also required is in-memory protection, and don't forget about the component properties, and if this is in .NET or Java you have to worry about immutable strings, and and and...
    – AviD ♦
    Dec 18, 2014 at 11:29

Not the answer you're looking for? Browse other questions tagged .