[WIP] Passman

[brantje]

[WIP] Passman

[oparoz]

Well, I would find it useful in a non-enterprise setting. Let's say you have a club, large family, etc.

• You're not going to install a password manager on every device owned by every member
• You don't want to maintain and send the XL sheet
• You don't want to send the password via email
• You don't want to be password tech support

So to be able to share amongst community members could be useful from my pov.

[BernhardPosselt]

Bikeshed incoming: no.

[oparoz]

I'd love to see OTP implemented to unlock all passwords instead of only relying on passwords

[brantje]

OTP is for eg; Google, when you login google asks for the One time password.
Passman will have the ability to generate those.

A 2 factor auth would be nice for passman, but maybe let NC handle that?

[animalillo]

I don't think OTP is viable or useful for passman, as the user is already authenticated, and the passwords are encyphered using a master AES key (in the current passman version, i can't think on a way that OTP could make it more secure or to implement it in a way worth the effort that increases the app security

[oparoz]

Yeah, you're probably right, the user is already authenticated and as long as he doesn't store his password in localstorage, he should be OK.

[animalillo]

as of for the sharing part, documentation on how to gather users and groups data from NextCloud apis would be neat.

[nickvergessen]

Ha, just yesterday I thought "man this app would really deserve an update".
Glad you have the same in mind.

[oparoz]

OCS Share API
https://docs.nextcloud.com/server/10/developer_manual/core/ocs-share-api.html

[brantje]

Let's start a discussion, is password sharing really needed?

[BernhardPosselt]

IMHO its like asking if a gun should be able to shoot backwards.

[animalillo]

hahahaha, true, but it has applications when you need to share some kind of passwords of sites that only allows 1 account to be created between different company members, better than putting them on an excel on a shared network folder would be a good password manager with nice security

[BernhardPosselt]

@animalillo use a gpg encrypted excel

[BernhardPosselt]

No, really in general you dont want that situation. If you have that situation I don't think theres anything better than the excel

[animalillo]

sure, then nobody would use the password manager, cause they can keep all their passwords in the confortable excel they are allowed to use, copy, travel around and share with anyone anywhere in many ways

[BernhardPosselt]

Password managers exist because you dont want to use the same password on all services. Nothing more.

[BernhardPosselt]

The more features you pile on the less secure it becomes. As for sharing passwords with other colleagues: don't do it.

[animalillo]

forgot to say "i don't need that password manager thing your IT dep has set up for us, we already have excel and we are already using it for this $shared_passwords"

and yeah, password managers are for using diferent passwords everywhere. i don't think sharing passwords is something you should usually do, but some times it's needed, and it's better if it's centralized for a company, that's my opinion

[BernhardPosselt]

Good luck with that company then :)

[animalillo]

it's also more secure, because you know who has access to the passwords and who doesn't. Of course, users are users and users are gonna act in unpredictable ways.

[nickvergessen]

👎 I dont need sharing as well

[brantje]

Updated todo list.

[oparoz]

Nice progress :)

[brantje]

Closing, created separate issues for the open tasks.