gowtham758550 / password-generator-and-manager Goto Github PK

If u generate more than one website name and password without exiting the program, it overwriting the previously generate website name and password. And also password count increases
ie. If your first password length is 10 , then if u create another password for another website with password length of 5 but it creates for 15(10+5).

I think we should have option to change master password assuming a worst case where a user may need to change it because he found it was compromised or for security reasons.

Since Third party modules are used Import Error is often encountered by newbie users documenting how to get them or including it within this project will make it easier for newbies.

Random module in python was never designed for use in Cryptography.
The secrets module is used for generating cryptographically strong random numbers suitable for managing data such as passwords, account authentication, security tokens, and related secrets.

More details available here : https://docs.python.org/3/library/secrets.html#module-secrets

Password Manager seems to exit arbitrarily if internet connection not avaiable . this is a critical issue as most of the time it will operate offline.

i am thinking if we could implement feature to easily import and export user passwords in a encrypted way so that it could be easy to do online backups without compromising security.

After first run of the program if user doesnot create any user password and directly tries to fetch password. The password manager crashes.

This bug seems to affect version 0.0.4.1 and we can assume previous versions are also affected!!!

Code documentation allows other developers to understand the code logic. It helps
improve the code by making it easy to find bugs and expand the project.

Clear screen not working in windows, only works in linux

The user password is cannot be fetched and throws no password generated even if a password was generated by user. ;(

There is a big hole in this program. If you delete mp.txt.aes file and create new password, your generated and managed passwords can be retrieved.
Fix it asap.

To reproduce the bug. Do Fresh installation of program. Enter password to create master password ( i entered sad ) and type same password in confirm password. Master password will be successfully created then when program askes enter password enter wrong password ( i typed bad ) and program crashes!
This is a severe bug. We must patch it soon. ;(

This bug seems to affect version 0.0.4.1 and we can assume previous versions are also affected!!!

The current password recovery tool doesnot work and we have to create a password cracking tool to crack passwords even though this can be extremly difficult .

To reproduce the bug. Do Fresh installation of program. Enter password to create master password ( i entered sad ) and type different password in confirm password ( i typed bad ) and program crashed!
This is a severe bug. We must patch it soon. ;(

i think we can add images of our project and better explain our project goals to make our project more better.
And no one does this better than gowtham so assigning gowtham for this issue :)

Currently i think our software needs lots of testing and i am trying hard to report issues.
We need someone to audit code to remove unnecessary lines of code and reduce amount of code.
Third party audits are better.

Assigning task to Gowtham.

Multiple antipatterns , performance issues were detected by deep source bot we should mitigate those issues and add deepsource bot much early in developing phase of software itself.

File automatically closes after creating or fetching something.

Gives an error like this.

Hashing Websites provides no additional security and is a waste of computing power and time.
i think it would be better to remove it.

affects version 0.0.4.2 only.
previous versions unaffected.

Password Manager seems to dump master password in temp.txt . Anyone who opens temp.txt can easily see the master password hence defeating the need of encryption.

This bug seems to affect version 0.0.4.1 and we can assume previous versions are also affected!!!

Currently i am working to fix this bug as soon as possible.

After installation of PyAesCrypt there is no import so it cause an error PyAesCrypt not defined. Add finally statement in try and import PyAesCrypt module to avoid this error

Due to pysecret integration all non alphabets and non numbers are treated as spaces in password which is used to derive key to encrypt the password store , this reduces the security of password manager. It is recommended to remove pysecret integration to fix this issue.
We should use password key derivation function like pbkdf2_hmac from hashlib to derive key securely.

Due to time and budget constraints , we can wait for some sponsor to fund us to fix this issue or make this project available to open source communities like up-for-grabs or open source friday or even during events like Hactoberfest.

Using Traditional ping method to check for internet connectivity to avoid errors due to low internet connectivity is slow. we are currently exploring a fix to this bug , currently the pip checks for such issues and reports errors.

Currently we use Pyaescrypt module which is a 3rd party module. should we stick with it or try cryptography module instead?

Password Manager crashes if secret.txt.aes or mp.txt.aes or key.txt files is corrupted.
We should provide a better way to handle such unexpected errors

It would be better to ask people not to use this project for their security needs and state that it
is a student developer project .

We can only create one user account like facebook.
After storing password for facebook.
it won't store password for any other account like google.

Affects version 0.0.4.2 and may be earlier versions too

Is your feature request related to a problem? Please describe.
Avoids phishing attacks

Describe the solution you'd like
store an additional field in database and load website when needed.

Describe alternatives you've considered
none

Additional context
none

The Password Recovery tool makes easy recovery of user passwords . Currently we have to fix this issue.
and make password recovery very hard for all , if it makes our recovery tool obsolete.

The pysecret project recently updated its code to make it highly efficient , it is highly advised to update this code to ensure code quality and performance. The work will be started as soon as possible after we fix on Decide on migrating away from Pyaescrypt . #27

Adding version numbers can help in better tracking of bugs and reporting changes in
changelog.

currently after adding feature to change master password the code changes mp.text by decrypting it and re-encrypting with new key to display changes but forgot to decrypt and re-encrypt secret.txt which has user passwords with new key, causing data corruption and loss of user passwords.

This issue is very severe and should be patched as soon as possible.

Software License makes the project usable by others for their own works.
It is important part of opensource projects. This source might help in choosing one : https://choosealicense.com/