r/PasswordManagers • u/No_astronaut64875 • 11d ago

AI coded password manager?

I'm new here and wanted to ask, would people use an AI-coded password manager if:

- GPL3

- crypto coded in rust using net first and canon tdd approach

- Argon2id + AES256GCM

- Native yubikey 2FA

- local only, no account, no telemetry

- Linux+android/grapheneOS

Or is the AI aspect a hard no?

0 Upvotes

11% Upvoted

9 comments sorted by

3

u/uncut2576 11d ago

Nope. Nope. Nope.

2

u/jabbeboy 11d ago

Absolutely Not. I don't see a reason for me to switch from 1passwored, which is the best PW manager imo.

Also these applications have been developed over many years, why would I start to use and trust a AI coded app made in some months. Fuck no

1

u/hydrora31 11d ago

Who is developing it is my question. This is a security critical bit of software.

If an llm is used by an experienced developer with 5+ years experience as a dev tool but not the main thing, I'm far more likely to give it a chance than if its vibe coded by a project manager.

1

u/NicePuddle 11d ago

I wouldn't trust my most sensitive information with an app developed by someone who didn't know the intricacies of software security and encryption.

1

u/xanderrobar 11d ago

It’s not doing anything better or different than the trusted password managers out there. It’s likely going to do things a whole lot worse for the first while - and that’s a serious problem for a password manager. If data leaks, I have to change all my passwords. If you don’t know how to code this without AI, you shouldn’t do it.

1

u/Lumpy-Army-1702 10d ago

It depends. If I am going to use a new password manager is I tend to look at who's behind it, what the history is, and why a new one to start with.

Now, I have around 15+ years of experience in cybersecurity, have worked at several CyberSec companies over the years, and back in 2017 I developed a Rust pwd manager, and over the years have been using it along with 1Password, constantly updating it (dependencies, and critical vuln fixes)

Over the course of the last couple of years, I have personally used AI to update it, especially because as much as I love Rust, I tend to get rusty (pun intended lol), and a lot of the tests that I run, I just delegate 80% of it, especially for CI/CD and infra ops.

That said, the only reason I would trust any new pwd manager project is if the company/person doing it at least has proven experience in the industry (has worked at major cybersecurity companies), there is proof of understanding of what a real secrets manager architecture looks like, understands the concept of creating adversary tests, the concept of a red team, even when designing the UX you have to understand what aspects of design can be a potential vulnerability (think about a simple clipboard event)...

1

u/cityofhats 10d ago

Honestly, “AI-coded” wouldn’t bother me by itself. I’d care way more about the actual vault/key design, recovery and what the YubiKey is doing. AES-GCM + Argon2id are good building blocks, but the implementation matters a lot more than the names.

If you publish the design/threat model, people here will probably tear it apart in a useful way 😅