0

I've created a terminal-based password manager in which we enter the master password and then we can choose either we have to add a new password or view the existing passwords. I've created it with the help of cryptography.fernet.

The only problem I have is that when the master password is entered for the first time we have the fernet key for it, but the next time when we even enter the wrong password it works in reality, it should only work when we enter the right password which we entered the first time to match with key but it works with wrong passwords too. Can I please get some help on it?

from cryptography.fernet import Fernet
from pickle import TRUE

def load_key():
file = open('key.key', 'rb')
key = file.read()
file.close()
return key

master_pwd = input("Enter your master pass : ")
key = load_key() + master_pwd.encode()
fer = Fernet(key)

#Functions
'''
def write_key():
    key = Fernet.generate_key()
    with open('key.key', 'wb') as key_file:
        key_file.write(key)

write_key()'''

def add():
    name = input("Enter the site name: ")
    url = input("Enter the site URL: ")
    email = input("Enter the email: ")
    pwd = input("Enter the Password: ")

    with open('passwords.txt', 'a') as f:
        f.write("Name: " + name + " | " + "URL: " + url + " | " "Email: " + email + " | " + fer.encrypt(pwd.encode()).decode() + "\n")

def view():
    with open('passwords.txt', 'r') as f:
        for line in f.readlines():
            data = line.rstrip()
            name, url, email, pwd = data.split("|")
            print(name, "|", url, "|", email, "|", "Password:", fer.decrypt(pwd.encode()).decode())
            
while True:
    print("1. Add a new Password: ")
    print("2. View existing Passwords: ")
    print("Enter q to quit: " "\n")
    mode = input()

    if mode == "q":
        print("Come Back Again :)")
        break

    if mode == "1":
        add()
    elif mode == "2":
        view()
    else:
        print("Invalid mode")
        break
Michael M.
  • 10,486
  • 9
  • 18
  • 34

1 Answers1

0

It's because Fernet(key) ignores extra bytes that you appended to the result of Fernet.generate_key(). If it had been implemented well, it should have thrown an exception.

Refer to the 'Using passwords with Fernet' section at the end of their documentation.

As a side note, 'cryptography' is somewhat an opinionated API, compared to other APIs such as PyCryptodome.

relent95
  • 3,703
  • 1
  • 14
  • 17