Skip to content
This repository has been archived by the owner on Nov 1, 2017. It is now read-only.

Commit

Permalink
Merge pull request #105 from github/project-status
Browse files Browse the repository at this point in the history 
Update README to reflect project status
  • Loading branch information
@bkeepers
bkeepers committed Feb 4, 2014
2 parents f66c642 + 5925b31 commit 86ad124
Showing 1 changed file with 2 additions and 20 deletions.
22 changes: 2 additions & 20 deletions README.md
View file
Original file line number Diff line number Diff line change
@@ -1,25 +1,7 @@
# Swordfish [![Build Status](https://secure.travis-ci.org/github/swordfish.png?branch=master)](http://travis-ci.org/github/swordfish)

Swordfish is an experiment in building a group-optimized password management
app. It is currently very alpha.
[Browse all the issues](https://github.com/github/swordfish/issues?milestone=)
to see what features are planned.

![mockup](http://cl.ly/image/472B0N460j2I/content)

## Is it secure?

Storing passwords on a server might seem like filling a lake in Alaska with
honey and expecting to keep bears out. I don't think it's like that. Why?

Even if an attacker gets access to your server or database, all secure items are
encrypted client side. The server has no idea what it is storing and no way of
decrypting it.

When you sign up, a RSA public/private keypair is generated in your browser. All
sensitive data is encrypted with your private key, which is password-protected
and never transferred to the server. No sensitive data is ever transmitted over
the wire unless it is encrypted with secrets only available on the client.
Swordfish was an experiment in building a group-optimized password management
app. It is unmaintained and is likely insecure.

## Recommended Reading

Expand Down

9 comments on commit 86ad124

@andyfowler
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😿 just had the weekly "gotta be a better way to manage shared passwords" talk in the office, and i checked in on this project again.

it was admirable work, @bkeepers! would love to hear what kind of setup you guys are using. for us, it's a shared keepass file. 😒

@bkeepers
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're using lastpass. Not great, but it works for those that need it.

@georgeguimaraes
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the investment in this project, @bkeepers. 👍

@andyfowler how do you share the keepass file? Dropbox?

@andyfowler
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@georgeguimaraes I was embarrassed to admit it in an open forum, but essentially, yes, it's a shared folder. We have a company Copy share. It's protected by a strong password, but it's not the greatest thing. Really it's only for silly services that require a shared login. But there are still a lot of those…

@jhubert
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andyfowler Fwiw, I did a whole bunch of research on this and the best available option turned out to be a KeePass file. I even explored other existing web based solutions, but they all ended up being a pain to use. KeePass balanced the ease of use with security quite well. Of course, I would prefer something like this tool, but just wanted to let you know there is nothing to be embarrassed about. :)

@BrendanThompson
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bkeepers any chance this will get some love again?

@andyfowler
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since I'm still on this thread, I'll just share that multiple 1Password vaults shared via Dropbox are now a feasible and (dare I say) pleasant experience. We're using two of them quite effectively at Nutshell. No more race conditions or out-of-band mutexes on the Keepass file.

Since 1Password persists the password for secondary vaults, you still only need your personal vault passphrase to work with the shared vault.

And it nudges the rest of your team to using 1Password for their own personal stuff, which means a more secure group.

@BrendanThompson
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andyfowler yeah currently using LastPass, however may consider changing to 1Password, you're the second person in so many days to give it a good wrap! Also Nutshell looks awesome!! Would love to get in contact with you about that!

@bkeepers
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any chance this will get some love again?

Not from me in the near future.

Please sign in to comment.