Why still blowfish?

[0xf10e]

Bruce Schneier was quoted in 2007 "At this point, though, I'm amazed [Blowfish is] still being used. If people ask, I recommend Twofish instead.". So why not Twofish (not considered broken by Bruce in 2005) or Threefish (might be considered showing little cracks but those are probably not bigger than the cracks in AES) if you want to stay with Bruce?

Going further down this lane one has, of course, suggest something like using scrypt to key the symmetric cipher.

• Twofish in Go
• Threefish in Go (as linked to on Schneier on Security)
• scrypt in Go

[seanpont]

You're right, passman is due for an update. I will make the encryption protocol configurable and the default will be scrypt.

[0xf10e]

Sweet, looking fwd to this update :)