YAPET - Yet Another Password Encryption Tool 0.3

Rafael Ostertag

$Id: README.sgml.in 2305 2009-04-13 11:27:46Z rafi $


Table of Contents

Introduction
Motivation
Supported Platforms
Features
Installation
Usage
Design
A Word of Caution

Introduction

YAPET is a curses based password encryption tool using the Blowfish encryption algorithm to store password records encrypted on disk. Its primary aim is to provide a safe way to store passwords in a file on disk while having a small footprint, and compiling and running under today's most popular Unixes, such as SunSolaris™, FreeBSD®, and Linux.

If you are looking for a fully fledged password encryption tool having a graphical user interface, I recommend you start with revelation (http://oss.codepoet.no/revelation). YAPET is text based and less feature rich in comparison to revelation.

Motivation

Using several different Unixes, I wanted to have a single application running on all Unixes for storing my passwords in a secure manner. While revelation is running fine under FreeBSD® and Linux, it's a pain to get it run under SunSolaris™ 10 (as you can see, the only tool I tried was revelation). It has many dependencies because it uses GNOME and PyGNOME. I didn't want to go thru the hassle of installing PyGNOME under SunSolaris™, and decided to roll my own.

Supported Platforms

YAPET successful builds and runs on following platforms:

  • FreeBSD®
  • SunSolaris™ x86
  • Linux
  • Cygwin

If you want to use YAPET under Cygwin, you may want to read the README.Cygwin file.

Features

YAPET features

Installation

YAPET uses a configure script for configuring the build process. Refer to the INSTALL file in the source tarball yapet-0.3.tar.gz.

Usage

YAPET is kept simple. You should not find it difficult to use. The user interface has some quirks, though.

See the manual page yapet(1) after installing YAPET for a minimal usage guide.

Design

Refer to the DESIGN file which comes along with the source tarball, in order to get an idea of the design of YAPET.

A Word of Caution

Although I took several precautions to avoid having any passwords stored clear text in memory, I was able to snoop up the master password in core files. This means for you, the user of YAPET, that it is possible, though not likely, for a malicious user to get hold of one or more passwords while YAPET is running. But remember, the passwords stored in the files created by YAPET are encrypted and not stored clear text. This is the best possible way of keeping them stored on a disk. The best overall method for keeping them, is to memorize them and not writing them down in any form.