🔐 Introducing Secure Vault .exe — file encryption that requires a physical USB key, not just a password
Why I built it: I wanted an encryption tool that doesn't trust a
vendor blindly — everything's open-source and verifiable, not a black
box. The tradeoff is real and deliberate: there's no password reset
and no backdoor. If you lose the USB drive or forget the password,
your files are permanently unrecoverable - even I can't help you get
them back. That's not a missing feature; a tool that COULD recover
your files without both would also be a tool that could be forced,
hacked, or tricked into doing that for someone else.
The upside of that tradeoff: even if someone steals your laptop AND
your password, they still can't open your files without the physical
USB stick in your pocket.
Neou
When ADHD takes you offline, Neou keeps you moving.
Comments (4)
Secure Vault’s combination of password protection and a physical USB key is an interesting approach to reducing the risks of stolen credentials and remote attacks. I also appreciate the transparency about the lack of an independent audit—being open-source and using established cryptographic standards gives security-conscious users a foundation to inspect and evaluate.
The recovery design seems especially important here. Can users securely register a backup USB key in case the original is lost, damaged, or corrupted? I would also be interested in seeing an independent security audit as the project grows. Congratulations on the launch!
Thank you, genuinely appreciate the thoughtful read.
Good question, and the honest answer is: not as a dedicated feature
right now. There's no "register backup key" option in the menu. What
you can do today is simpler - since the key file on the USB is already
encrypted with your password (not stored raw), it's safe to just copy
that file directly onto a second USB drive with normal file copy.
Either drive then works interchangeably, same password unlocks both.
It's a manual step right now rather than something the app walks you
through, which honestly it should - that's a good, concrete feature
request and I'll add proper backup-key guidance (maybe even an
automated "clone this key to another drive" menu option) based on
this.
And yes, completely agree on the audit - it's the most important thing
still missing here. Right now it's community code review (which has
already caught and fixed real issues, written up in the changelog) but
that's not a substitute for a proper independent audit. It's the next
real milestone once there's enough traction to justify it.
Appreciate you flagging both - exactly the kind of question that
should be answered in the docs, not just in a comment thread.
Honest read from someone outside your field, since your comment count says you might be getting only expert eyes.
I did not understand this post. AES-256-GCM and HMAC mean nothing to me, and they are the first concrete things you say. I got the USB idea, but I could not tell what I would gain or risk.
2 questions I would want answered before I installed it, and I think most non-technical people would ask the same:
What happens if I lose the USB drive? Right now I assume my files are gone forever, and if that is true it needs to be stated plainly rather than left for me to work out. It is a fair trade, but I want to make it knowingly.
Every other tool has a forgotten-password recovery. Yours cannot, if I have understood it. That is the point of the design, but to a normal user it reads as a missing feature rather than a deliberate one, so say why out loud.
The line that would have sold me is not in the post: "even if someone steals your laptop and your password, they still cannot open your files without the physical stick in your pocket." That I understood immediately.
I launched WorkstationAI here today and I have the mirror-image version of your problem: mine looks too simple, so people file it as another CV tool. If you have 10 minutes to tell me where you stop reading, I would owe you one.
Yes. If you lose the USB drive and don't have a backup of the key
file, your files are gone permanently. No recovery, no support
ticket that fixes it, nothing.
- That's deliberate, not a missing feature. A tool that COULD recover
your files without the drive would also be a tool that could be
forced, hacked, or tricked into doing that for someone else. I
didn't want a back door disguised as a convenience.
And that line you wrote - "even if someone steals your laptop and
your password, they still cannot open your files without the physical
stick in your pocket" - is better than anything I wrote in the actual
post. Mind if I just use it? Genuinely.
I'd take you up on the 10 minutes for WorkstationAI - trade feels more
than fair given what you just handed me. I'll go look at it and tell
you exactly where I stop reading and why, same way you just did for
me.
Sign in to comment or upvote.