Struggling to validate this idea: do people actually care about this problem?
I’ve been thinking about a side project, but I’m stuck on whether the problem is even real or if I’m just overengineering something. Password managers are good at telling you what’s been compromised, but the fix is still completely manual. So I started…
I’ve been thinking about a side project, but I’m stuck on whether the problem is even real or if I’m just overengineering something. Password managers are good at telling you what’s been compromised, but the fix is still completely manual. So I started wondering if there’s actually something useful here or if it’s just a “nice idea in theory”. The concept I was exploring is a browser extension that could: rotates your passwords on a schedule or after a breach logs into supported sites and updates the password automatically verifies the new login through your inbox before retiring the old password stores everything locally (no central password database)(Open GitHub) will be open source, so anyone can verify how it works The biggest feedback I've received from friends is security, which is fair. That's why passwords never leave your device; there's no server or database for us to breach Would really appreciate honest takes from people who’ve built or validated ideas before.
Collected discussion
Ah I see. Ok looks like I'll start building shortly!
Aye indeed. I'll find a way around it and do some digging. Appreciate the feedback.
I’d validate the trust problem before the automation problem. The scary part for users is not “can this change my password,” it’s “do I trust a new extension to touch my accounts at all.” A lighter first test might be breach-triggered guidance or a manual checklist that proves people actually want the workflow before you build the full auto-rotation path.
Appreciate the feedback. I'm adding this information to explore.
That’s a good next step. I’d write the riskiest assumption as one sentence: “someone trusts this enough to run it on one low-stakes account.” If that fails, the automation depth won’t matter; if it passes, then you can learn which parts of the workflow people actually want delegated.
I have not yet. I only looked at problems people wanted as a solution that these chrome extensions of SaaS MVP did not provide, and this was a well-requested feature. I'll have to look further to see if it is the case that some people have found a loophole around it.
the tell isnt whether people say they care, its whether theyve already hacked together some duct-tape workaround for it. if theyre living with the problem quietly, its real. if they shrug and move on, it probably isnt worth building yet. have you found anyone already solving it the ugly manual way?
I had the same idea written down in my product notebook. I think its a relevant idea worth building. Unfortunately its a tough market, requiring trust security and compliance with big players in the space.
Concept of "local" does not exist anymore the moment you let the tool go and change your passwords in online services. You are connected to the internet. That's not local. I am having a hard time thinking anybody would use something like this as a regular password manager. Maybe if you position it as an emergency response tool to mass change your credentials.
This comment was deleted.