secrez 1.1.2 → 1.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +168 -227
- package/bin/secrez.js +8 -2
- package/coverage.report +301 -53
- package/package.json +2 -2
- package/src/PreCommand.js +1 -0
- package/src/commands/Export.js +50 -4
- package/src/commands/Touch.js +1 -1
- package/src/prompts/ChatPrompt.js +1 -0
- package/src/prompts/CommandPrompt.js +22 -0
- package/src/prompts/MainPrompt.js +4 -0
package/README.md
CHANGED
|
@@ -31,91 +31,55 @@
|
|
|
31
31
|
|
|
32
32
|
</p>
|
|
33
33
|
|
|
34
|
-
Secrez is
|
|
35
|
-
|
|
36
|
-
- a CLI secret manager working as an encrypted file system;
|
|
37
|
-
- a decentralized surveillance-resistant end-to-end encrypted messaging system.
|
|
34
|
+
Secrez is a CLI secret manager that functions as an encrypted file system, as well as a decentralized, surveillance-resistant, end-to-end encrypted messaging system.
|
|
38
35
|
|
|
39
36
|
## Intro
|
|
40
37
|
|
|
41
|
-
At
|
|
42
|
-
|
|
43
|
-
The idea is to interact with encrypted virtual files as if they are just files in a standard file system.
|
|
38
|
+
At its core, Secrez is a command-line interface that manages an encrypted file system, with commands that work similarly to Unix commands like `cd`, `mkdir`, `ls`, `mv`, etc. The idea is to interact with encrypted virtual files as if they are just files in a standard file system.
|
|
44
39
|
|
|
45
40
|
## Why Secrez?
|
|
46
41
|
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
1. Online systems that save the data online (like LastPass)
|
|
50
|
-
2. Desktop tools who keep data in the computer (like KeyPass)
|
|
51
|
-
|
|
52
|
-
An Online Password Manager requires that you trust the remote server.
|
|
53
|
-
I founded Passpack in 2006, and I know very well how, at any moment, you can add a backdoor —— even only for a specific user —— and most likely nobody will notice it.
|
|
54
|
-
|
|
55
|
-
The second case, a desktop tool is intrinsically more secure, but it is hard to use on more than one computer.
|
|
56
|
-
The standard solution is to backup the database on Dropbox or Google Drive and —— before using it —— download it locally, which is prone to produce unfixable problems and cause data loss.
|
|
57
|
-
|
|
58
|
-
Secrez's goal is to be as safe as KeyPass but available everywhere, like Lastpass.
|
|
42
|
+
Secrez aims to provide a secure password management solution that is available everywhere. While online password managers like LastPass require you to trust a remote server, desktop tools like KeyPass are more secure but difficult to use on multiple computers. To address this, Secrez combines the security of KeyPass with the accessibility of LastPass.
|
|
59
43
|
|
|
60
|
-
To
|
|
44
|
+
To achieve its goal, Secrez uses several strategies. First, any secret is a local file. Second, any file, whether it's a tree version, a directory, a text file, or a binary file, is immutable. Finally, any change can be pulled/pushed to a remote private repository. You can either create a private repository on GitHub, BitBucket, etc. or set up your own self-hosted Git server.
|
|
61
45
|
|
|
62
|
-
|
|
63
|
-
- Any file — besides if it is a tree version, a directory, a text file, or a binary file — is immutable
|
|
64
|
-
- Any change can be pulled/pushed to a remote private repo
|
|
46
|
+
In addition to functioning as a password manager, Secrez also includes an optional decentralized, surveillance-resistant, end-to-end encrypted messaging system. This provides an extra layer of security for your communications, ensuring that your messages cannot be intercepted or read by anyone other than the intended recipient.
|
|
65
47
|
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
For now, this is a manual approach. In a future version, the git repo will be manageable from inside Secrez.
|
|
48
|
+
Overall, Secrez offers a powerful and secure solution for managing your passwords and secrets, all from the command line.
|
|
69
49
|
|
|
70
50
|
## The structure
|
|
71
51
|
|
|
72
|
-
Secrez simulates an operating system
|
|
73
|
-
|
|
74
|
-
Starting from version `0.6.0`, the data are organized in datasets. Think of them like separate disks, something like `/dev/disk1` and `/dev/disk2`.
|
|
75
|
-
|
|
76
|
-
By default, Secrez generates two datasets: `main` and `trash`. You can create more with, for example, `use -c archive`. The advantage of multiple datasets is mostly for people who have a lot of secrets to manage. If you have 2,000, if they are all in the primary dataset, the system will probably become quite slow. The solution is to move data to separate datasets (`archive`, `backup`, `twitter`, `cryptos`, etc.)
|
|
77
|
-
|
|
78
|
-
## Secrez never lose secrets
|
|
79
|
-
|
|
80
|
-
One of the primary goal of a secrets manager is that you will never lose any data.
|
|
81
|
-
|
|
82
|
-
However, since only the most recent index is read, some secrets could be in the folder and not been loaded.
|
|
52
|
+
Secrez simulates an operating system, allowing you to execute commands like ls and mv when you load the environment, similar to what you would normally do in a Unix terminal.
|
|
83
53
|
|
|
84
|
-
|
|
54
|
+
Starting from version 0.6.0, Secrez organizes data into datasets, which act like separate disks, such as /dev/disk1 and /dev/disk2. By default, Secrez generates two datasets: main and trash. You can create more using the use -c command, such as use -c archive.
|
|
55
|
+
One of the primary goals of a secrets manager is to ensure that no data is ever lost. However, in some cases, secrets may exist in a folder but not be loaded if only the most recent index is read.
|
|
85
56
|
|
|
86
|
-
When GitHub
|
|
57
|
+
Here's an example: Alice uses Secrez on both computer A and B, and the two data sets are aligned. Suddenly, GitHub goes down, and she makes some changes on both computers. When GitHub comes back online, she pushes the master branch on computer A, and everything goes fine. However, when she pulls on computer B and pushes, the data online become inconsistent because the most recent tree (from B) does not contain the new changes that were previously saved on A. This means that some secrets are in one index, while others are in the other.
|
|
87
58
|
|
|
88
|
-
|
|
89
|
-
Now, the data online are not consistent because the most recent tree (from B) does not contains the new changes saved previously on A, i.e., some secrets are in one index, some are in the other one.
|
|
59
|
+
No problem. When Alice restarts Secrez, the system finds the extra secrets, reads their positions from the previous indexes, and puts them back in the tree. Since files are immutable, the recovery strategy is not always obvious. Here's what happens in different cases:
|
|
90
60
|
|
|
91
|
-
|
|
61
|
+
If the recovered secret is in a folder that does not exist in the "official" index, the entire path is added using the encrypted data of the recovered secret.
|
|
62
|
+
If the secret is a file in a folder that already exists, the file is added as is, but the folders with existing paths are trashed.
|
|
63
|
+
If the secret is a file and a file with the same name already exists in the same position, the system checks the content of the file. If it is the same, the secret is ignored. If it's different, it is added as a version.
|
|
64
|
+
Any unused or rewritten secrets (as versions) are trashed (you can check them in the trash dataset). In any case, all the contents are kept.
|
|
92
65
|
|
|
93
|
-
|
|
66
|
+
To avoid repeating the same process on the other computer (which will generate files with different IDs and more deleted items), Alice should align the repo on computer A before doing anything there. But if she doesn't, nothing will be lost anyway.
|
|
94
67
|
|
|
95
|
-
|
|
96
|
-
2. The secret is a file in a folder that actually exists. The file is added as is, but the folders with existent paths are trashed.
|
|
97
|
-
3. The secret is a file but a file with the same name exists in the same position. The system checks the content of the file. If it is the same, the secret is ignored, if not it is added as a version.
|
|
98
|
-
|
|
99
|
-
Either any unused secret or secret that is rewritten (as a version) is trashed (you can check them in the `trash` dataset).
|
|
100
|
-
|
|
101
|
-
In any case, all the contents are kept.
|
|
102
|
-
|
|
103
|
-
To avoid to repeat the same process on the other computer (which will generate files with different IDs and more deleted items), Alice should align the repo on A before doing anything there. But, if she does not, nothing will be lost anyway.
|
|
68
|
+
Thus said, **it is a good practice to align the repo before doing anything. You never know.**
|
|
104
69
|
|
|
105
70
|
## The name convention
|
|
106
71
|
|
|
107
|
-
|
|
72
|
+
In Secrez, file names follow a specific convention:
|
|
108
73
|
|
|
109
74
|
```
|
|
110
75
|
1VAnGLojzCDWhfZRK8PCYK203WBzJkAA28FhKHdS7DM5SkJaTgYdGfN1MAjTdfUYSzvtDVsMJvGodoHWzMuK6zr
|
|
111
76
|
```
|
|
112
77
|
|
|
113
|
-
|
|
78
|
+
The first character, 1, indicates the type of file. The remaining characters represent an encrypted message with a nonce, in Base58 format. The encrypted part consists of an ID, timestamp, and the actual filename.
|
|
114
79
|
|
|
115
|
-
|
|
116
|
-
This implies that, at bootstrap, Secrez must read all the files' names and build a tree of the entire file system. This is done using particular files: trees. Only after reading all the data, Secrez is able to understand which is the tree and, if something is missed, add the missing secrets. Since everything is encrypted, there is no information deductible from the files on disk, except what you can deduct from the Git repo (mostly about versioning and timestamp). But the idea is to use a private repo, so this is a minor issue.
|
|
80
|
+
During initialization, Secrez reads all file names and builds a tree of the entire file system. This is done using special files called trees. Once all data has been read, Secrez can determine the tree and add any missing secrets. Since everything is encrypted, it is not possible to deduce information from the files on disk, except for versioning and timestamps, which can be obtained from the Git repo.
|
|
117
81
|
|
|
118
|
-
To mitigate this risk, you can create a new Git repo, save everything as the first commit, and delete the previously used repo. This
|
|
82
|
+
To mitigate this risk, you can create a new Git repo, save everything as the first commit, and delete the previously used repo. This will result in losing the repo's history, but it will also prevent someone from accessing information about timestamps and versions.
|
|
119
83
|
|
|
120
84
|
## The tree
|
|
121
85
|
|
|
@@ -123,26 +87,19 @@ Secrez manages trees as single immutable files. During a session, temporary file
|
|
|
123
87
|
|
|
124
88
|
## The cryptographic foundation
|
|
125
89
|
|
|
126
|
-
|
|
90
|
+
Secrez uses [NaCl](https://github.com/dchest/tweetnacl-js) as its primary cryptographic library. NaCl is a widely respected library that provides many algorithms for both synchronous and asynchronous encryption, and its design has been rigorously reviewed by experts in the field. By using NaCl, Secrez is able to provide strong security guarantees for its users.
|
|
127
91
|
|
|
128
92
|
## How to install it
|
|
129
93
|
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
To install Secrez globally you can use Npm
|
|
133
|
-
|
|
134
|
-
```
|
|
135
|
-
npm install -g secrez
|
|
136
|
-
```
|
|
94
|
+
Secrez requires at least Node 10. If you have installed a previous version, it may generate unclear errors and refuse to install or work properly. We recommend installing Node using nvm if possible. For more information, refer to [https://github.com/nvm-sh/nvm](https://github.com/nvm-sh/nvm).
|
|
137
95
|
|
|
138
|
-
|
|
139
|
-
To install pnpm run
|
|
96
|
+
Since this monorepo uses [Pnpm](https://pnpm.io/), it is better to install secrez using pnpm because the lock file will be used to avoid unexpected conflicts among modules. To install pnpm, run:
|
|
140
97
|
|
|
141
98
|
```
|
|
142
99
|
npm i -g pnpm
|
|
143
100
|
```
|
|
144
101
|
|
|
145
|
-
and
|
|
102
|
+
and then run:
|
|
146
103
|
|
|
147
104
|
```
|
|
148
105
|
pnpm i -g secrez
|
|
@@ -150,76 +107,53 @@ pnpm i -g secrez
|
|
|
150
107
|
|
|
151
108
|
## How to use it
|
|
152
109
|
|
|
153
|
-
|
|
110
|
+
To get started with Secrez, simply run the command:
|
|
154
111
|
|
|
155
112
|
```
|
|
156
113
|
secrez
|
|
157
114
|
```
|
|
158
115
|
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
Since Secrez derives a master key from your password using `crypto.pbkdf2`, the number of iterations is a significant addition to the general security because the number of iterations is part of the salt used for the derivation. Even if you use a not-very-hard-to-guess password, if the attacker does not know the number of iterations, he has to try all the possible ones. Considering that 2,000,000 iterations require a second or so, customizable iterations increases enormously the overall security.
|
|
162
|
-
|
|
163
|
-
At first launch, you can also explicitly set up the number of iterations:
|
|
116
|
+
Upon first launch, Secrez will prompt you to enter a master password and the number of iterations. The number of iterations is used to derive a master key from your password, so the higher the number, the more secure your data will be. It's recommended to use between 500,000 and 1,000,000 iterations, but you can customize this based on your needs. For example, you can set the number of iterations explicitly by running:
|
|
164
117
|
|
|
165
118
|
```
|
|
166
119
|
secrez -i 1023896
|
|
167
120
|
```
|
|
168
121
|
|
|
169
|
-
|
|
170
|
-
|
|
171
|
-
```
|
|
172
|
-
secrez -si 876352
|
|
173
|
-
```
|
|
174
|
-
|
|
175
|
-
where the `-s` option saves the number locally in a git-ignored `env.json` file. This way you don't have to retype it all the time to launch Secrez (typing a wrong number of iterations, of course, will produce an error).
|
|
176
|
-
|
|
177
|
-
You can save locally the number of iterations adding the options `-s`, like:
|
|
122
|
+
You can also save the number of iterations locally by adding the -s option:
|
|
178
123
|
|
|
179
124
|
```
|
|
180
125
|
secrez -s
|
|
181
126
|
```
|
|
182
127
|
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
Other options at launch are:
|
|
128
|
+
This will save the number of iterations in a git-ignored env.json file, so you don't have to enter it every time you launch Secrez. If you mistype the number of iterations, Secrez will produce an error.
|
|
186
129
|
|
|
187
|
-
|
|
188
|
-
- `-c` to set up the container (i.e, the folder) where the encrypted data are located
|
|
189
|
-
|
|
190
|
-
By default, both folders are your homedir (`~`).
|
|
191
|
-
|
|
192
|
-
Running Secrez in different containers (with the `-c` option), you can set up multiple independent encrypted databases. For example:
|
|
130
|
+
In addition to the master password and number of iterations, you can also specify other options at launch, such as the initial "external" folder on your computer (-l option) and the container (i.e., the folder) where the encrypted data is located (-c option). By default, both folders are set to your home directory (~). For example, if you want to set up a separate encrypted database in a different folder, you can run:
|
|
193
131
|
|
|
194
132
|
```
|
|
195
133
|
secrez -c ~/data/secrez
|
|
196
134
|
```
|
|
197
135
|
|
|
136
|
+
If the number of iterations you chose makes the initial decryption too slow, you can change it inside the Secrez CLI with the conf command.
|
|
137
|
+
|
|
198
138
|
## The commands
|
|
199
139
|
|
|
140
|
+
Launching `help` you can list all available commands.
|
|
141
|
+
|
|
200
142
|
```
|
|
143
|
+
Available commands:
|
|
201
144
|
alias Create aliases of other commands.
|
|
145
|
+
bash << deprecated - use "shell" instead
|
|
202
146
|
cat Shows the content of a file.
|
|
203
147
|
cd Changes the working directory.
|
|
204
148
|
chat Enters the Secrez chat
|
|
205
|
-
|
|
206
|
-
help This help.
|
|
207
|
-
join Joins conversation.
|
|
208
|
-
leave Leaves a room
|
|
209
|
-
quit Quit the chat environment
|
|
210
|
-
send Sends either a room or the chat
|
|
211
|
-
show Show chat history in a room
|
|
212
|
-
whoami Show data that other users need to chat with you
|
|
213
|
-
conf Configure security data (2FA, password, number of iterations).
|
|
149
|
+
conf Shows current configuration and allow to change password and number of iterations).
|
|
214
150
|
contacts Manages your contacts
|
|
215
151
|
copy Copy a text file to the clipboard.
|
|
216
152
|
courier Configure the connection to a local courier
|
|
217
153
|
ds Manages datasets
|
|
218
154
|
edit Edits a file containing a secret.
|
|
219
|
-
exit << deprecated - use "quit" instead
|
|
220
155
|
export Export encrypted data to the OS in the current local folder
|
|
221
156
|
find Find a secret.
|
|
222
|
-
git Pushes to a repo and pulls from a repo.
|
|
223
157
|
help This help.
|
|
224
158
|
import Import files from the OS into the current folder
|
|
225
159
|
lcat Similar to a standard cat in the external fs.
|
|
@@ -233,7 +167,7 @@ secrez -c ~/data/secrez
|
|
|
233
167
|
pwd Shows the path of the working directory.
|
|
234
168
|
quit Quits Secrez.
|
|
235
169
|
rm Removes one or more files and folders.
|
|
236
|
-
shell Execute a
|
|
170
|
+
shell Execute a shell command in the current disk folder.
|
|
237
171
|
ssh Opens a new tab and run ssh to connect to a remote server via SSH
|
|
238
172
|
tag Tags a file and shows existent tags.
|
|
239
173
|
totp Generate a TOTP code if a totp field exists in the card.
|
|
@@ -246,45 +180,43 @@ secrez -c ~/data/secrez
|
|
|
246
180
|
|
|
247
181
|
## Some example
|
|
248
182
|
|
|
183
|
+
To display the content of an encrypted file called myPrivateKey, run the following command:
|
|
184
|
+
|
|
249
185
|
```
|
|
250
186
|
cat myPrivateKey
|
|
251
187
|
```
|
|
252
188
|
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
Adding options to the command, it is possible to either see a specific version or list all the versions.
|
|
189
|
+
By default, the latest version of the file will be displayed. However, you can use additional options to view a specific version or list all versions.
|
|
256
190
|
|
|
257
|
-
|
|
191
|
+
Secrez uses versioning to ensure data integrity and avoid conflicts when backing up and distributing data through Git. Each time a file is modified, a new encrypted file is created with metadata about its ID and timestamp. The timestamp is used to assign a version to the file, which is a 4-letter hash of the timestamp.
|
|
258
192
|
|
|
259
|
-
|
|
260
|
-
|
|
261
|
-
Another example:
|
|
193
|
+
Another useful command is the import command. For example:
|
|
262
194
|
|
|
263
195
|
```
|
|
264
196
|
import ~/Desktop/myWallet.json -m
|
|
265
197
|
```
|
|
266
198
|
|
|
267
|
-
This command
|
|
199
|
+
This command will encrypt the file myWallet.json located on your Desktop, save it in the encrypted file system, and then delete the original file using the -m option.
|
|
268
200
|
|
|
269
|
-
This is
|
|
201
|
+
This is particularly useful if you have just downloaded a private key to access your crypto wallet and want to encrypt it as soon as possible. With Secrez, you can import the file and delete the cleartext version in one command.
|
|
270
202
|
|
|
271
|
-
## Aliases — where the fun
|
|
203
|
+
## Aliases — where the fun begins :-)
|
|
272
204
|
|
|
273
|
-
Suppose
|
|
205
|
+
Suppose you have a bank card and want to log in to your online account. You could copy the email and password to the clipboard to paste them in the browser. If you expect to be able to move from the terminal to the browser in 4 seconds, you could run the command:
|
|
274
206
|
|
|
275
207
|
```
|
|
276
208
|
copy bank.yml -f email password -d 4 2
|
|
277
209
|
```
|
|
278
210
|
|
|
279
|
-
This will copy the email field and give you 4 seconds to paste it in the browser. Then, it will emit a beep and you have 2 seconds to paste the password. It sounds quite useful, but it can be better.
|
|
211
|
+
This will copy the email field and give you 4 seconds to paste it in the browser. Then, it will emit a beep, and you have 2 seconds to paste the password. It sounds quite useful, but it can be even better.
|
|
280
212
|
|
|
281
|
-
If you use that login often, you could
|
|
213
|
+
If you use that login often, you could create an alias for it with:
|
|
282
214
|
|
|
283
215
|
```
|
|
284
|
-
alias b -c "copy bank.yml -f email password -d 4 2
|
|
216
|
+
alias b -c "copy bank.yml -f email password -d 4 2"
|
|
285
217
|
```
|
|
286
218
|
|
|
287
|
-
Next time, you can just type
|
|
219
|
+
Next time, you can just type:
|
|
288
220
|
|
|
289
221
|
```
|
|
290
222
|
b
|
|
@@ -292,13 +224,13 @@ b
|
|
|
292
224
|
|
|
293
225
|
It looks great, right? Well, it can be even better.
|
|
294
226
|
|
|
295
|
-
Let’s say
|
|
227
|
+
Let’s say you're using a 2FA app like Google Authenticator to connect to a website, for example, GitHub. Suppose you have a file called github.yml with a field called totp, which is the secret that GitHub gave you when you activated 2FA. You could execute:
|
|
296
228
|
|
|
297
229
|
```
|
|
298
230
|
totp github.yml
|
|
299
231
|
```
|
|
300
232
|
|
|
301
|
-
to generate a TOTP token for GitHub. The token will be shown and copied
|
|
233
|
+
to generate a TOTP token for GitHub. The token will be shown and copied to the clipboard. Now, you can create an alias like this:
|
|
302
234
|
|
|
303
235
|
```
|
|
304
236
|
alias G -c "copy github.yml -f username password -d 4 2 --wait && totp github.yml"
|
|
@@ -306,31 +238,28 @@ alias G -c "copy github.yml -f username password -d 4 2 --wait && totp github.ym
|
|
|
306
238
|
|
|
307
239
|
Can you guess what this will do?
|
|
308
240
|
|
|
309
|
-
|
|
310
|
-
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
You can also use parameters in aliases and create a macro like
|
|
241
|
+
It copies the username to the clipboard;
|
|
242
|
+
It waits 5 seconds, emits a beep, and copies the password;
|
|
243
|
+
It waits 3 seconds, emits a beep, and copies the TOTP token, keeping it in the clipboard.
|
|
244
|
+
You can also use parameters in aliases and create a macro like this:
|
|
314
245
|
|
|
315
246
|
```
|
|
316
247
|
alias M -c "copy $1 -f username password -d 4 2 --wait && totp $1"
|
|
317
248
|
```
|
|
318
249
|
|
|
319
|
-
and call it with
|
|
250
|
+
and call it with:
|
|
320
251
|
|
|
321
252
|
```
|
|
322
253
|
M github.yml
|
|
323
254
|
```
|
|
324
255
|
|
|
325
|
-
It
|
|
256
|
+
It's fantastic, isn't it?
|
|
326
257
|
|
|
327
|
-
_Btw, using a TOTP factor in Secrez is a bit of a contradiction
|
|
258
|
+
_Btw, using a TOTP factor in Secrez is a bit of a contradiction because you are converting a second factor (something that you have) into a first factor (something that you know). So, use this feature only when it makes sense._
|
|
328
259
|
|
|
329
260
|
## Importing from other password/secret managers
|
|
330
261
|
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
Suppose you have exported your password in a CSV file name export.csv like this:
|
|
262
|
+
Secrez supports importing backups from other software. Suppose you have exported your passwords in a CSV file named export.csv like this:
|
|
334
263
|
|
|
335
264
|
```
|
|
336
265
|
Path,Username,Password,Web Site,Notes
|
|
@@ -341,17 +270,17 @@ line
|
|
|
341
270
|
notes"
|
|
342
271
|
```
|
|
343
272
|
|
|
344
|
-
|
|
273
|
+
A field named path is necessary because Secrez needs to know where to place the new data. The path should be relative, allowing you to import it into your favorite folder.
|
|
345
274
|
|
|
346
|
-
|
|
275
|
+
To import the CSV file into the 1PasswordData folder, for example, you can run:
|
|
347
276
|
|
|
348
277
|
```
|
|
349
278
|
import export.csv -e 1PasswordData -t
|
|
350
279
|
```
|
|
351
280
|
|
|
352
|
-
The parameter
|
|
281
|
+
The parameter -e or --expand is necessary. If it's not provided, Secrez will import the file as a single file.
|
|
353
282
|
|
|
354
|
-
Internally, Secrez converts the CSV
|
|
283
|
+
Internally, Secrez converts the CSV file to a JSON file like this:
|
|
355
284
|
|
|
356
285
|
```
|
|
357
286
|
[
|
|
@@ -375,13 +304,13 @@ Internally, Secrez converts the CSV in a JSON file like this:
|
|
|
375
304
|
]
|
|
376
305
|
```
|
|
377
306
|
|
|
378
|
-
|
|
307
|
+
This means that you can also format your data as a JSON and import it directly using:
|
|
379
308
|
|
|
380
309
|
```
|
|
381
310
|
import export.json -e 1PasswordData
|
|
382
311
|
```
|
|
383
312
|
|
|
384
|
-
|
|
313
|
+
Each item in the JSON will generate a single YAML file. For example, the last element in the JSON will generate the file /1PasswordDate/somePath.yml with the following content:
|
|
385
314
|
|
|
386
315
|
```
|
|
387
316
|
password: s83832jedjdj
|
|
@@ -392,44 +321,43 @@ notes: |-
|
|
|
392
321
|
notes
|
|
393
322
|
```
|
|
394
323
|
|
|
395
|
-
When you edit the new file, Secrez
|
|
324
|
+
When you edit the new file, Secrez recognizes it as a card and asks you which field you want to edit (unless you explicitly specify it with, for example, -f password) and edits just that field.
|
|
396
325
|
|
|
397
|
-
At the end of the process, you can remove the original backup
|
|
398
|
-
You can also simulate the process to see which files will be created with the option `-s`.
|
|
326
|
+
At the end of the process, you can remove the original backup using the -m option. You can also simulate the process to see which files will be created using the -s option.
|
|
399
327
|
|
|
400
|
-
If
|
|
328
|
+
If the CSV file also contains a tags field, you can automatically tag any entries using the -t or --tags option. If you don't use this option, the tags will be saved in the YAML file like any other field.
|
|
401
329
|
|
|
402
330
|
### What if there is no path field?
|
|
403
331
|
|
|
404
|
-
Let's say
|
|
332
|
+
Let's say you want to import a CSV file exported by LastPass, which doesn't have a path field. In this case, you can use other fields, such as grouping and name, to build the path instead. Starting from version 0.8.8, you can do this by running:
|
|
405
333
|
|
|
406
334
|
```
|
|
407
335
|
import ~/Downloads/lastpass_export.csv -e lastpass -P grouping name
|
|
408
336
|
```
|
|
409
337
|
|
|
410
|
-
|
|
338
|
+
Or, if you want to put everything in the folder `lastpass` without generating any subfolders, you can run:
|
|
411
339
|
|
|
412
340
|
```
|
|
413
341
|
import ~/Downloads/lastpass_export.csv -e lastpass -P name -m
|
|
414
342
|
```
|
|
415
343
|
|
|
416
|
-
using only the
|
|
344
|
+
By using only the name field, any entries with a slash in the name will create a subfolder. The -m option will remove the CSV file from the operating system after importing.
|
|
417
345
|
|
|
418
|
-
In
|
|
346
|
+
In both examples, make sure that all entries in the LastPass CSV file have a name. If not, the import will fail because Secrez won't know how to name the file.
|
|
419
347
|
|
|
420
348
|
### Best practices
|
|
421
349
|
|
|
422
|
-
For security
|
|
350
|
+
For security reasons, it is better to export from your password manager and import into Secrez as quickly as possible, removing the exported file from your OS using -m.
|
|
423
351
|
|
|
424
|
-
|
|
352
|
+
However, if you need to edit the exported file to fix paths and names, it is more convenient to do it before importing the data, as it can take a lot more time to do so after the data is imported.
|
|
425
353
|
|
|
426
|
-
##
|
|
354
|
+
## FIDO2 second factor authentication?
|
|
427
355
|
|
|
428
|
-
|
|
356
|
+
It has been removed in version 0.11.0 due to potential critical issues with Python and the required libraries on MacOS (2FA may be restored if a pure Javascript library becomes available).
|
|
429
357
|
|
|
430
358
|
## (experimental) End-to-end encrypted communication with other accounts
|
|
431
359
|
|
|
432
|
-
Starting from version 0.8.0, Secrez allows to exchange encrypted messages with other users. To do
|
|
360
|
+
Starting from version 0.8.0, Secrez allows you to exchange encrypted messages with other users. To do so, you must set up a local Courier ([look here for more info](https://github.com/secrez/secrez/tree/master/packages/courier)).
|
|
433
361
|
|
|
434
362
|
## Blog posts
|
|
435
363
|
|
|
@@ -439,16 +367,21 @@ Starting from version 0.8.0, Secrez allows to exchange encrypted messages with o
|
|
|
439
367
|
|
|
440
368
|
## Some thoughts
|
|
441
369
|
|
|
442
|
-
Secrez
|
|
370
|
+
Secrez is not intended to compete with password managers, so do not expect it to have features like "form filling." The idea behind Secrez originated in 2017 when I was participating in many ICOs, and I had so many files to save, but any password manager I used was not very effective. Secrez is file-oriented and will likely remain so. However, it is open source, and someone is welcome to build a GUI or mobile app built on it.
|
|
443
371
|
|
|
444
|
-
##
|
|
372
|
+
## History
|
|
445
373
|
|
|
446
|
-
|
|
447
|
-
- Plugin architecture to allow others to add their own commands
|
|
374
|
+
**1.1.4**
|
|
448
375
|
|
|
449
|
-
|
|
376
|
+
- add clear screen after 180 seconds to avoid that the user forgot its terminal open and accidentally shares it while sharing the screen during meetings — it happened to me :-(
|
|
377
|
+
- add option `--timeout, -t` to customize the timeout when launching secrez
|
|
378
|
+
|
|
379
|
+
**1.1.3**
|
|
450
380
|
|
|
451
|
-
|
|
381
|
+
- add new option `--keystore, -k` to `export`. If a file contains a private key field (i.e., a field with a name containing `private_key`), it can be exported in the keystore format. The file will have the same name with the extension replaced with `.keystore.json`.
|
|
382
|
+
- this README has been redacted by ChatGPT to make it more clear and concise.
|
|
383
|
+
|
|
384
|
+
**1.1.2**
|
|
452
385
|
|
|
453
386
|
- New options for `touch`:
|
|
454
387
|
- `--wait-for-content` to prompt the user to add the content, instead of expecting it as a parameter. The content will be trimmed at the first newline, if there is any.
|
|
@@ -456,6 +389,10 @@ Secrez does not want to compete with password managers. So, don't expect in the
|
|
|
456
389
|
- `--prefix` in combination with `--generate-wallet` specifies the prefix of the field, calling the fields, for example `my_private_key` and `my_address` if the prefix is `my`.
|
|
457
390
|
- `--amount` in combination with `--generate-wallet` specifies the amount of wallets to generate. The default is 1.
|
|
458
391
|
|
|
392
|
+
**1.1.1** (unpublished)
|
|
393
|
+
|
|
394
|
+
- using prettier for consistent formatting
|
|
395
|
+
|
|
459
396
|
**1.1.0**
|
|
460
397
|
|
|
461
398
|
- Remove `git`. If used carefully, the command was helpful, but still it is at risk of creating conflicts. After long thoughts, I disapproved my own proposal at: https://github.com/secrez/secrez/pull/163
|
|
@@ -824,64 +761,57 @@ npm run reset
|
|
|
824
761
|
|
|
825
762
|
#### Install OS requirements
|
|
826
763
|
|
|
827
|
-
To complete the tests, you must install some
|
|
764
|
+
To complete the tests, you must install some tools depending on your operating system.
|
|
828
765
|
|
|
829
|
-
The `copy` command does not work on Linux
|
|
766
|
+
The `copy` command does not work on Linux if `xsel` is not installed. So, if you are working on Ubuntu, install it with:
|
|
830
767
|
|
|
831
768
|
```
|
|
832
769
|
sudo apt install xsel
|
|
833
770
|
```
|
|
834
771
|
|
|
835
|
-
The `totp` command requires
|
|
772
|
+
The `totp` command requires `pngpaste` on macOS. You can install it with:
|
|
836
773
|
|
|
837
774
|
```
|
|
838
775
|
brew install pngpaste
|
|
839
776
|
```
|
|
840
777
|
|
|
841
|
-
|
|
842
|
-
|
|
843
|
-
```
|
|
844
|
-
pip install fido2
|
|
845
|
-
```
|
|
846
|
-
|
|
847
|
-
Notice that during the execution of Secrez, an error is generated if those tools have not been found. But, nothing happens, during testing. So, please, install them.
|
|
778
|
+
Please note that during the execution of Secrez, an error is generated if those tools have not been found. Please make sure to install them.
|
|
848
779
|
|
|
849
780
|
#### Testing
|
|
850
781
|
|
|
851
|
-
|
|
782
|
+
To run all the tests, navigate to the root directory of the project and run:
|
|
852
783
|
|
|
853
784
|
```
|
|
854
785
|
npm run test
|
|
855
786
|
```
|
|
856
787
|
|
|
857
|
-
|
|
858
|
-
You can also run
|
|
788
|
+
If you are inside a package directory, running this command will only execute the package-specific tests. You can also skip coverage by running:
|
|
859
789
|
|
|
860
790
|
```
|
|
861
791
|
npm run test-only
|
|
862
792
|
```
|
|
863
793
|
|
|
864
|
-
|
|
794
|
+
This is useful during development.
|
|
865
795
|
|
|
866
796
|
#### Debugging
|
|
867
797
|
|
|
868
|
-
To see if
|
|
798
|
+
To see if Secrez works properly, you can execute your version of Secrez by running the following command from inside the `packages/secrez` directory:
|
|
869
799
|
|
|
870
800
|
```
|
|
871
801
|
npm run dev
|
|
872
802
|
```
|
|
873
803
|
|
|
874
|
-
|
|
804
|
+
You will create a dev account to play with it.
|
|
875
805
|
|
|
876
806
|
#### Pull Requests
|
|
877
807
|
|
|
878
|
-
|
|
808
|
+
Before submitting a pull request, you should realign the versions. You can do this by running the following command from the root directory:
|
|
879
809
|
|
|
880
810
|
```
|
|
881
811
|
npm run patch-versions
|
|
882
812
|
```
|
|
883
813
|
|
|
884
|
-
Then, you can prepare the README inserting the coverage. To do
|
|
814
|
+
Then, you can prepare the README file by inserting the coverage. To do this, run:
|
|
885
815
|
|
|
886
816
|
```
|
|
887
817
|
npm run pre-push
|
|
@@ -889,73 +819,84 @@ npm run pre-push
|
|
|
889
819
|
|
|
890
820
|
Finally, you can push to GitHub.
|
|
891
821
|
|
|
892
|
-
|
|
822
|
+
Thank you for any contributions! 😉
|
|
893
823
|
|
|
894
824
|
## Test coverage
|
|
895
825
|
|
|
896
826
|
```
|
|
897
|
-
|
|
827
|
+
166 passing (24s)
|
|
828
|
+
1 pending
|
|
898
829
|
|
|
899
830
|
-----------------------|---------|----------|---------|---------|-----------------------------------
|
|
900
831
|
File | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s
|
|
901
832
|
-----------------------|---------|----------|---------|---------|-----------------------------------
|
|
902
|
-
All files |
|
|
903
|
-
src |
|
|
904
|
-
Command.js |
|
|
905
|
-
PreCommand.js |
|
|
833
|
+
All files | 71.22 | 58.41 | 71.25 | 71.11 |
|
|
834
|
+
src | 59.63 | 54.79 | 55 | 60.19 |
|
|
835
|
+
Command.js | 79.66 | 78.72 | 76.92 | 81.03 | 32,55-62,73,80,119
|
|
836
|
+
PreCommand.js | 21.95 | 11.54 | 14.29 | 21.95 | 8-99,116
|
|
906
837
|
cliConfig.js | 100 | 100 | 100 | 100 |
|
|
907
|
-
src/commands |
|
|
908
|
-
Alias.js |
|
|
909
|
-
Bash.js |
|
|
910
|
-
Cat.js |
|
|
911
|
-
Cd.js |
|
|
838
|
+
src/commands | 81.53 | 67 | 89.95 | 81.4 |
|
|
839
|
+
Alias.js | 90.54 | 77.36 | 100 | 90.41 | 101,112,139,169,173,180,190
|
|
840
|
+
Bash.js | 75 | 0 | 66.67 | 75 | 18-19
|
|
841
|
+
Cat.js | 98.9 | 88.89 | 100 | 98.9 | 152
|
|
842
|
+
Cd.js | 96.43 | 86.67 | 100 | 96.43 | 44
|
|
912
843
|
Chat.js | 19.51 | 0 | 16.67 | 19.51 | 23-144
|
|
913
|
-
Conf.js |
|
|
914
|
-
Contacts.js |
|
|
915
|
-
Copy.js |
|
|
916
|
-
Courier.js |
|
|
917
|
-
Ds.js |
|
|
918
|
-
Edit.js |
|
|
919
|
-
Export.js |
|
|
920
|
-
Find.js |
|
|
921
|
-
Help.js |
|
|
922
|
-
Import.js |
|
|
923
|
-
Lcat.js |
|
|
924
|
-
Lcd.js |
|
|
925
|
-
Lls.js |
|
|
926
|
-
Lpwd.js |
|
|
927
|
-
Ls.js |
|
|
928
|
-
Mkdir.js |
|
|
929
|
-
Mv.js |
|
|
930
|
-
Paste.js |
|
|
931
|
-
Pwd.js |
|
|
932
|
-
Quit.js |
|
|
933
|
-
Rm.js |
|
|
934
|
-
Shell.js |
|
|
935
|
-
Ssh.js |
|
|
936
|
-
Tag.js |
|
|
937
|
-
Totp.js |
|
|
844
|
+
Conf.js | 10.45 | 0 | 25 | 10.45 | 134-499
|
|
845
|
+
Contacts.js | 74.67 | 65.98 | 92.86 | 74.5 | ...90-214,240,247,259,315,328,338
|
|
846
|
+
Copy.js | 94.87 | 74.51 | 100 | 94.81 | 111,162,179,204
|
|
847
|
+
Courier.js | 63.54 | 41.86 | 85.71 | 63.83 | ...37,152-171,188,200-203,215-221
|
|
848
|
+
Ds.js | 92.54 | 82.05 | 100 | 92.42 | 99,108-113,125
|
|
849
|
+
Edit.js | 13.58 | 0 | 40 | 13.58 | 88-214
|
|
850
|
+
Export.js | 87.63 | 67.74 | 100 | 87.63 | ...66,175,182-186,191,203,212,215
|
|
851
|
+
Find.js | 93.59 | 86.67 | 100 | 93.42 | 101,164,200-203,209
|
|
852
|
+
Help.js | 100 | 80 | 100 | 100 | 29
|
|
853
|
+
Import.js | 93.2 | 85.48 | 100 | 93.14 | ...65,367,387,393,441,456-463,490
|
|
854
|
+
Lcat.js | 100 | 85.71 | 100 | 100 | 54
|
|
855
|
+
Lcd.js | 95.65 | 81.82 | 100 | 95.65 | 50
|
|
856
|
+
Lls.js | 95.45 | 72.73 | 100 | 95.45 | 97
|
|
857
|
+
Lpwd.js | 92.31 | 100 | 100 | 92.31 | 36
|
|
858
|
+
Ls.js | 91.3 | 75 | 100 | 90.77 | 103,114-116,130,181
|
|
859
|
+
Mkdir.js | 100 | 66.67 | 100 | 100 | 38-44
|
|
860
|
+
Mv.js | 88.04 | 73.21 | 100 | 87.78 | 93-99,133,155,165-172
|
|
861
|
+
Paste.js | 87.23 | 75 | 100 | 87.23 | 72,78,81,89,113,129
|
|
862
|
+
Pwd.js | 92.31 | 100 | 100 | 92.31 | 33
|
|
863
|
+
Quit.js | 90 | 50 | 100 | 90 | 27
|
|
864
|
+
Rm.js | 94 | 80.95 | 100 | 93.88 | 63,126,134
|
|
865
|
+
Shell.js | 88.24 | 60 | 100 | 88.24 | 38,55
|
|
866
|
+
Ssh.js | 25 | 0 | 40 | 25 | 72-120
|
|
867
|
+
Tag.js | 98.04 | 92.31 | 100 | 98.02 | 122,171
|
|
868
|
+
Totp.js | 96.47 | 74.47 | 100 | 96.47 | 188-189,235
|
|
938
869
|
Touch.js | 95.92 | 81.48 | 100 | 95.83 | 152,202
|
|
939
|
-
Use.js |
|
|
940
|
-
Ver.js |
|
|
941
|
-
Whoami.js |
|
|
942
|
-
chat.js |
|
|
943
|
-
index.js |
|
|
944
|
-
src/
|
|
945
|
-
|
|
946
|
-
|
|
947
|
-
|
|
870
|
+
Use.js | 96.77 | 89.47 | 100 | 96.77 | 68
|
|
871
|
+
Ver.js | 90 | 66.67 | 100 | 90 | 25
|
|
872
|
+
Whoami.js | 93.1 | 63.64 | 80 | 93.1 | 29,64
|
|
873
|
+
chat.js | 85.37 | 53.85 | 100 | 85.37 | 105,117-130,136,142
|
|
874
|
+
index.js | 91.67 | 60 | 100 | 91.3 | 22,31
|
|
875
|
+
src/commands/chat | 79.44 | 63.29 | 92.31 | 79.33 |
|
|
876
|
+
Contacts.js | 80 | 42.86 | 80 | 80 | 54,65,69,81
|
|
877
|
+
Help.js | 86.67 | 60 | 100 | 86.67 | 37-38
|
|
878
|
+
Join.js | 95.65 | 82.61 | 100 | 95.56 | 43,110
|
|
879
|
+
Leave.js | 100 | 60 | 100 | 100 | 24,28
|
|
880
|
+
Quit.js | 100 | 75 | 100 | 100 | 24
|
|
881
|
+
Send.js | 67.65 | 46.67 | 100 | 67.65 | 37,41,44,77,86-95
|
|
882
|
+
Show.js | 68.75 | 70.59 | 100 | 68.75 | 74-78,87,102-108
|
|
883
|
+
Whoami.js | 42.86 | 0 | 60 | 42.86 | 22,30-39
|
|
884
|
+
src/prompts | 14.72 | 0 | 13.43 | 14.85 |
|
|
885
|
+
ChatPrompt.js | 6.1 | 0 | 0 | 6.1 | 8-164
|
|
886
|
+
ChatPromptMock.js | 100 | 100 | 66.67 | 100 |
|
|
887
|
+
CommandPrompt.js | 9.8 | 0 | 0 | 9.93 | 24-318
|
|
948
888
|
Completion.js | 4.41 | 0 | 0 | 4.48 | 6-103
|
|
949
|
-
MainPromptMock.js | 100 | 100 |
|
|
889
|
+
MainPromptMock.js | 100 | 100 | 66.67 | 100 |
|
|
950
890
|
MultiEditorPrompt.js | 25 | 0 | 0 | 25 | 7-36
|
|
951
891
|
SigintManager.js | 25 | 0 | 20 | 25 | 10-36
|
|
952
|
-
src/utils |
|
|
953
|
-
AliasManager.js |
|
|
954
|
-
ContactManager.js |
|
|
955
|
-
Fido2Client.js |
|
|
956
|
-
HelpProto.js |
|
|
957
|
-
Logger.js |
|
|
892
|
+
src/utils | 69.92 | 63.28 | 56.25 | 69.55 |
|
|
893
|
+
AliasManager.js | 100 | 91.67 | 100 | 100 | 47
|
|
894
|
+
ContactManager.js | 71.43 | 60 | 85.71 | 71.43 | 12,35-37
|
|
895
|
+
Fido2Client.js | 15.38 | 0 | 11.11 | 15.38 | 14-108
|
|
896
|
+
HelpProto.js | 91.6 | 84.06 | 100 | 91.45 | 49,153-154,171-176,195
|
|
897
|
+
Logger.js | 63.64 | 56.25 | 36.84 | 62.79 | ...37-49,57,65-69,74,84,88,93,105
|
|
958
898
|
-----------------------|---------|----------|---------|---------|-----------------------------------
|
|
899
|
+
|
|
959
900
|
```
|
|
960
901
|
|
|
961
902
|
## Copyright
|