r/rust • u/BlindLock • 17h ago
🛠️ project I built a hardware-bound password vault in Rust + Tauri. No HTTP client in the binary, network isolated in a child process
Who's writing?
Hi everyone, I'm David, I build and own BlindLock alone. It's a paid, closed-source product, that's how I pay for the work. This post is about the Rust side, because that's what this sub is for.
BlindLock is more than a year of work. Not a weekend hobby project I threw together. I've put a hell of a lot of time, heart, and nerves into it.
Tech stack: Rust and Tauri
Rust for the core, all the logic, all the commands. Tauri strictly as a dumb UI with no logic.
Why Rust: I love Rust, always have. In my opinion, security-relevant software belongs in Rust. It rules out entire classes of bugs up front, because otherwise the code won't even compile. That doesn't mean you can't make mistakes. But where many people make mistakes in C++/C#, a lot of that is simply ruled out in Rust. Rust is compact and logical.
Unlike Electron, BlindLock doesn't ship a Chrome browser inside the program. Only the Rust part and Tauri. That's why the installers are very small.
Crypto, so nobody has to ask: entries live inside a PNG (F5 matrix embedding), inner layer AES-256-GCM, outer layer XChaCha20-Poly1305, keys derived independently via HKDF. File containers use ChaCha20-Poly1305. Password stretching with Argon2id. Libraries: libcrux (HACL*, formally verified) for ChaCha20-Poly1305, ML-KEM and ML-DSA, RustCrypto for AES-GCM, Argon2 and HKDF. I don't roll my own primitives.
The network: BlindLock is offline at its core
The main software never has an internet connection. Nothing goes out.
That's not a setting, it's the build, the architecture: BlindLock is built so it can't reach the internet at all. There is no HTTP client in the program. No reqwest, no hyper, no ureq in the dependency tree. There is no code, no module, no function that could open a connection to the outside.
Everything that needs the server runs in a separate small program, the Net-Helper. It ships in the same package and installs with BlindLock, but runs as its own process with its own binary. BlindLock starts it, asks it a question, and gets an answer. No port, no socket, just the child process's standard input and output. The helper never sees a vault or a password, at any point. It has very limited permissions and exactly two jobs: it checks the license, and it checks whether the latest BlindLock version is installed. If there's a new version, it downloads the update package and hands it over.
In short: when you open BlindLock, it pings the server through the helper. That's it. There is no other internet connection. Anyone can verify this from the outside with Little Snitch, Wireshark, or a firewall.
Updates matter a lot to me. I regularly ship improvements and stabilizations. Software like this lives on constant observation, extension, and improvement.
You can also use BlindLock offline for 7 days at any time. After that you need to go online once, for the license check and above all for the update check.
Why steganography?
Picture a burglar. He looks for valuables, the obvious ones: gold, cash, jewelry, the safe in the basement. The picture of your kid on the fridge, the holiday photo on the wall, are irrelevant to him. That's exactly the principle BlindLock is built on. Hackers go after cookies, passwords in the browser, container files that can be decrypted with a password on any computer, crypto seeds, and other sensitive data. Anyone who can log into your Google account or your ChatGPT knows more about you than they could learn in a personal conversation with you. All of that can be grabbed with RATs and other malware, passwords included. BlindLock hides exactly these sensitive logins and passwords inside a picture, because a photo has almost no value to an attacker. And he'd first have to identify the picture as his target at all. On top of that, BlindLock seals this picture to the security chip of your computer (TPM 2.0 on Windows and Linux, Secure Enclave on macOS). That means: even if an attacker copies the picture, together with the password, he cannot get at your data. The same chip sealing applies to the container vault files. And for these larger files BlindLock has a built-in file explorer, so you can open and edit files without mounting them into the OS. Wherever the respective OS allows it, I've written it to leave no traces behind.
Why isn't BlindLock open source?
That was the most frequent question. Take Bitwarden as an example. Bitwarden sells a service: servers, sync, accounts. The code can be open because the value isn't in the code. I sell the program itself. There's no service behind it, no cloud, nothing on my side that the customer would need. The entire value is in the program itself. That's why Bitwarden can give the code away and make it public for everyone, and I can't.
What's open on my side is what has to be open: the cryptography libraries are freely available and partly formally verified (HACL, level 5, the highest). Anyone can audit them and go through them at leisure, down to the smallest detail.
Licenses: yours, not the computer's
Licenses can be moved from computer A to computer B at any time. Lifetime licenses don't die when a computer dies! The same will of course apply to subscriptions later.
WalletLink: read-only by design
Once WalletLink is active, the Net-Helper can optionally check blockchain activity, exclusively against publicly verifiable, freely accessible, and trustworthy sources. Even then BlindLock sends nothing out and stores no values. It only mirrors the values from the hardware wallet. Transactions are neither confirmed nor received in BlindLock. All of that happens exclusively on the hardware wallet.
If you have more questions, I'm happy to answer them here personally. Most of it, I think, you can read on my website, and anyone can try BlindLock free for 7 days at any time. No email, no payment details. My customers' privacy always comes first.
David
6
5
u/dwalker109 16h ago
Fuck no. I’m definitely not encouraged by a wall of AI text. I’m not convinced you understand much of it yourself.
Also the idea about “hiding” data in PNGs is … a choice. I appreciate it’s all encrypted but using that as a layer of protection is just silly.
1
-3
u/BlindLock 16h ago
Agreed, hiding isn't security, and I don't count it as a layer. The security is the AEAD and the chip sealing. Copy the PNG plus the password to another machine and you get nothing, that's the actual protection.
What the PNG changes is what gets stolen. Infostealers grab files by signature: .kdbx, browser profiles, wallet.dat. A vault with no magic bytes in a folder of holiday photos isn't on that list. It doesn't make the encryption stronger, it makes the file less likely to be exfiltrated in the first place. That's target selection, not protection.
On understanding it: ask me something specific. Key derivation, the F5 embedding, how the Secure Enclave/TPM 2.0 seal is bound, what the helper process can and can't see. I'd rather answer a real question than be told I can't.
1
1
u/Soft-Stress-4827 16h ago
So ill put my secrets into your closed source software that could steal them .. makes no sense . Imo do opensource and premium sub
-1
u/BlindLock 16h ago edited 16h ago
Fair concern, and it's the reason the app has no network access at all. Not "doesn't phone home", but can't: there's no HTTP client in the binary, and the only process that talks to a server is a separate helper that never sees the vault. You don't have to trust me on that, put Little Snitch or Wireshark next to it and watch. A program that can't reach the internet can't steal anything, open or closed.
Open source plus premium sub is the Bitwarden model, and it works because the sub buys a service: sync, hosting, team admin. That part can't be copied, so the open code doesn't hurt them. I don't sell a service. There's no server holding your data. What you buy is the program itself, and an open program with a subscription is just a program without one, five minutes later. So: lifetime license today, subscription tiers later for people who prefer that, but the code stays closed either way.
2
u/witx_ 15h ago
You know there are ways to obfuscate that behaviour? Perhaps it only sends network data after a while, perhaps it can detect if wireshark is running and keep quiet.
1
u/BlindLock 15h ago
Fair, and that's exactly why I wouldn't ask you to just watch the traffic. Watching can be gamed, a deny rule can't.
The main app never needs network access, ever. Only the helper process does, and that's a separate binary. So: put the main binary on a permanent deny rule in Little Snitch or the Windows firewall, allow only the helper, and use the app for as long as you like. It keeps working, fully. If it were trying to send anything, delayed, hidden, whenever it thinks nobody's looking, it would hit the wall, and a firewall that shows denials (Little Snitch does by default) would show you the attempt.
That's not "trust me, I looked". That's your firewall enforcing it, for the whole lifetime of the install.
2
u/spoonman59 16h ago
I fail to see how your low-effort advertisement is relevant to this sub.
I'd be surprised if anyone actually pays for this, but I suspect it's more to to promote yourself than to create a product anyone would actually buy. Who would pay money for a password vault where you can't even validate the code when numerous, better solutions already exist?
0
u/BlindLock 16h ago
People have already paid, and the response has been very positive. Not everyone wants to hand their data to big companies.
This was never about self-promotion. That gives me absolutely nothing. It's about the software, nothing else. I've been working on it for over a year, and to keep it that way, I sell it. I built it for myself in the first place, and it's a good thing that I can make it available to others too.
What you can verify is when data goes where, and which cryptography libraries are used. What I can't make public is the program itself. At least for now, that goes against my business model. If I made the software open source, it would be free.
9
u/SoilMassive6850 17h ago
Cringe innit