// HACKER NEWS — CYBERSECURITY
I built a hardware-bound local password vault hidden in a photo
Steganography means concealing data inside an ordinary-looking file. Your complete password vault lives encrypted inside a PNG carrier, with no recognisable vault file to advertise its presence.
Encrypted data stolen today can be stored and attacked later. BlindLock does not run a central vault database — there is nothing for attackers to steal from BlindLock servers and crack later. Your resting vault file uses 256-bit authenticated encryption — under known quantum attacks on symmetric crypto, a work factor generally treated as impractical. The stack also includes the NIST post-quantum components ML-KEM-1024 and ML-DSA-87 (FIPS 203/204). Where each is deployed is documented on the Security page.
The vault opens only when three things match: the carrier file, your master password and your authorised device. A copied file alone is not enough to gain access.
Credentials stored fully encrypted inside your PNG carrier.
Balances and addresses from your crypto accounts, without private keys. You prepare a transaction in BlindLock and approve it on your external hardware wallet. BlindLock itself approves nothing and holds no assets.
Files of any kind, in separate encrypted containers.
Plain text and Markdown stored inside the same encrypted carrier.
Optional fourth factor: plug in a YubiKey, Google Titan, or SoloKey (desktop).
Any PNG image on your device. A vacation photo works perfectly.
You set your password, and the vault is tied to your device. Optionally add a security key such as a YubiKey, Google Titan, or SoloKey.