buttercup / buttercup-core

:tophat: The mighty NodeJS password vault
http://buttercup.pw/
MIT License
468 stars 58 forks source link

Attachments #254

Closed matthewcmead closed 4 years ago

matthewcmead commented 5 years ago

Referencing 1Password for comparison...

A useful feature of 1Password is its ability to store attachments in its secure notes. This would be a welcome addition to buttercup core and the clients.

perry-mitchell commented 5 years ago

To give some history: We’ve discussed this for some time already, but without result. I’m surprised there’s not another open issue for it, so thanks for opening this. Attachments are tricky because we don’t want to store them in the vault file - the history stored inside each vault is tiny, and attachments are huge.. It’d be bad for sync and read/write if we were to add them to the some payload (which is currently also text based, not binary).

This leaves us with few options, one of which being the ability to store them alongside the vault file in a folder with a similar name to the vault. This so far seems like a reasonable approach at least, and entries could simply reference the items by file name.

claywd commented 5 years ago

@perry-mitchell Exactly. Store them a folder alongside the vault, encrypt it with the master password and decrypt when the archive is unlocked for lookup. Keep a path in the DB linked to the UUID of the kv in the archive and all should be well. If I get some time I'll try to contribute to this. Do you prefer feature branches or forks for upstream contributions?

perry-mitchell commented 5 years ago

Forks work better imo. Yeah we should still think about the folder name and bits like that, but I think having this added to the data sources repo would be best - they’re the connection to the remote storage, and should provide methods that allow for creating and fetching attachments, creating the attachment directory etc.

perry-mitchell commented 4 years ago

Basic support for attachments has been merged - See #273 for the file datasource implementation, which needs doing.