[9front] Secstore security questions

[9front] Secstore security questions

[sirjofri]

Good morning,

I'm thinking about secstore and how to incorporate it in a general use password manager for other systems. That makes me ask: how secure is secstore security? Thinking about protocol and encryption and stuff, also in combination with a radius server, for example.

In the past I've heard that its security is somewhat outdated and I shouldn't have a public facing secstore server, but I never heard any actual arguments about it. Given that it's an old software, how secure is it? Should it be updated if used as a public facing service?

sirjofri

Re: [9front] Secstore security questions

[cinap_lenrek]

secstore should be replaced eventually, yes.

for encrypted storage, i wrote stashfs to be eventually
used for this. it uses the scrypt key derivation
function and uses xsalsa for encryption.

and for the pake, we can use dp9ik's pake.

for the file-access, just use 9p instead of
that custom FTP-like protocol.

just need a good way to plug these things together.

--
cinap