opqpwd
opqpwd is a password manager REST service with client-side encryption.
It is written in Python 3, using Django and Django REST framework.
opqpwd stands for “opaque passwords”: it encrypts password on the client-side, making them “opaque” to the server. Moreover, user registration and authentication is performed using salted hashes of user-chosen username and password: this boosts users anonimity with respect to traditional services, hiding even the service-registration username.
Passwords (and metadata) are stored in your favorite database as Base64-encoded, encrypted JSON. Encryption is performed using AES-256-CBC, with HMAC-SHA-256 authentication.
scrypt is used as key derivation function.
It features an example command-line client (you can find it in the bin folder).
opqpwd was written by Marco Bellaccini - marco.bellaccini(at!)gmail.com.
BEWARE: OPQPWD IS PROOF-OF-CONCEPT SOFTWARE, FOR TESTING PURPOSES ONLY.
Quick start
Make sure you meet all software dependencies (Django REST Framework, scrypt - you’ll need libssl-dev for it, pycrypto, requests and, of course, Django).
Add “opqpwd” and “rest_framework” (of course, you have to install Django REST Framework too!) to your INSTALLED_APPS setting like this:
INSTALLED_APPS = [ ... 'rest_framework', 'opqpwd', ]In the same file (settings.py), specify this custom authentication backend:
# set custom authentication backend AUTHENTICATION_BACKENDS = ['opqpwd.authentication.UserCredBackend']
Include the opqpwd URLconf in your project urls.py like this:
url(r'^', include('opqpwd.urls')),Note: make sure you import include with from django.conf.urls import include.
Run python manage.py migrate to create the opqpwd models.
Start the development server (BEWARE: in a real environment you should run it over https, however, as already stated, THIS IS A PROOF-OF-CONCEPT SOFTWARE, FOR TESTING PURPOSES ONLY).
Start the cli-client script:
opqpwdcliclient
Note: if you installed the package as a user library, the script will likely be in .local/bin in your home folder.
Connect to the development server:
connect http://127.0.0.1:8000
Register a user:
adduser
(if you want, you can also generate an authentication token to use along with the password)
Login:
login
Add a password to the db:
addpassword
List all stored passwords titles:
printall
Print details of the password you just stored:
print 1
Upload encrypted passwords to the server:
save
Get help with the other commands:
help
Metadata
Release files for django-opqpwd 0.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| django-opqpwd-0.1.tar.gz | 20.6 kB | Without provenance | Details for django-opqpwd-0.1.tar.gz |
Release files / django-opqpwd-0.1.tar.gz
| Download URL | django-opqpwd-0.1.tar.gz |
|---|---|
| Size | 20.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
aa8ee044cf91443d149ad8f25393873f3f13770db5a7f2aeba84553e11c16def
|
|
BLAKE2b-256 checksum How to use checksums |
62ef066d8755bccc55661d48a5ead6c571acd411fd54c62ef2340feb2b1138df
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for django-opqpwd 0.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.