oxur / rucksack

A terminal-based secrets manager, generator, and importer/exporter (Firefox, Chrome) backed with a concurrent hashmap
Apache License 2.0
12 stars 1 forks source link

Retain a history of old passwords #76

Closed oubiwann closed 1 year ago

oubiwann commented 1 year ago

1password focuses on passwords, so their secret data is a little simpler than ours: they just push the old pass onto a history vec/array. This won't work for us since in addition to passwords, we do service creds, asymmetric crypto files, certs, etc.. Our current setup for decrypted records is this:

pub struct DecryptedRecord {
    pub secrets: Secrets,
    pub metadata: Metadata,
}

In order to retain old passwords with their metadata (most useful would probably be last updated and last accessed), we'd want a Vec of DecryptedRecord ... so maybe something like this?

pub struct DecryptedRecord {
    pub secrets: Secrets,
    pub metadata: Metadata,
    pub history: Vec<DecryptedRecord>
}

This means, of course, that we'll have to update EncryptedRecord similarly. Maybe something like:

pub struct EncryptedRecord {
    pub key: String,
    pub value: Vec<u8>,
    pub metadata: Metadata,
    pub history: Vec<u8>,
}

with history getting the same encryption treatment that value does ...

Tasks:

oubiwann commented 1 year ago

This does beg the question about growing DB sizes ... might have to explore a different solution in the future (Rucksack is decrypted to in-mem to avoid writing sensitive data to disk. Might be able to so some clever juggling with partially loading a BTree in-memory ...

oubiwann commented 1 year ago

I think I was looking at some old or incomplete 1password docs ... because their list of supported types is rather extensive. I didn't see SSL certs, but they've got all sorts of crazy stuff they support.