This sounds like a good idea.  How would this be integrated into secrets?  
Would 
secrets link against a library that can parse the xml files, or would secrets 
parse 
the files itself?

Can you provide an example xml file that would be used for password management 
type 
apps?

Thanks.

My understanding is that there is a libopensync, so Secrets would need to write 
a
plugin that converts from Secrets format to something more generic.

I don't know a lot about the technical aspects, but I don't think that any other
password programs use OpenSync -- probably because no others use it yet.

I would expect that the OpenSync devs would be keen to help you do this. The 
list is
here:
https://lists.sourceforge.net/lists/listinfo/opensync-devel

I can only hope you're not thinking about adding a network sync. I really that 
warm fuzzy feeling of safety when the application I use to store some of my 
secrets does not even have the permission to send anything over the network.

We can argue that it's an open source app, so everybody would see if it was 
doing something wrong, but network access would still make me feel uneasy. In 
the end it's not like someone is screening every update?

Paranoid? Maybe a bit. But there's plenty of other applications that support 
more or less elaborate synchronisation scenarios. Personally, I like the 
simplicity of this application as is — just stores stuff, and exports them on 
the card, if you ask it to. I hope such option will stay there forever.

Hi pitkali,

You are not paranoid, nor are you alone in getting that warm and fuzzy feeling 
about apps that don't have internet access.  At this point internet access is 
not a permission that Secrets will ever ask for.

Sync'ing with the "desktop" is something that lots of people have asked for 
though, and even I sometimes wished there was something like that.  I've been 
thinking about a solution to this problem for a little while now (and because 
of these security issues I'm moving deliberately slowly).  The solution is 
along the lines of installing a second, totally separate app that privately 
communicates with Secrets and syncs with some online service (not a desktop).

The bottom line then is this: those who don't need sync'ing can install Secrets 
only, with no ability for your secrets to reach the internet.  Those who want 
sync'ing would need to install another app as well, with the knowledge that 
this configuration will send your secrets to an online destination of their 
choice.

Does this still give you that warm and fuzzy feeling?