Credentials Passwords idea - Page 1
Forum section: electronics / projects

author: akis
author_rank: Frequent Contributor
timestamp: May 03, 2014, 02:44:20 pm
content: I was thinking of a device, the size of a Zippo lighter, or smaller, that has some memory on it, a USB connection, bluetooth and a small LCD display plus a tiny battery to power the LCD/bluetooth.The device would have some software on it, that would store and retrieve personal details, in encrypted form. It would have a micro SD slot to allow back up of data in case you lost the device. All encrypted of course. It would use a master password plus second level authentication like random letters from a second password, and it would have some unlock feature in case you lost your master passwords.This device would allow anyone to store all their passwords and all sensitive information and make it available anywhere even without a PC near by. Bluetooth would be used to present the data on a smartphone. The LCD would allow you to retrieve data directly.That would be the most secure method of storing personal information, with no man in the middle problems like those "password managers" which rely on online databases handled by companies and be open to hackers, unscrupulous employees, governments court orders and so on. Read on "silk road" for examples of persistent and repeated theft of personal information from online dtabases.

author: 8086
author_rank: Super Contributor
timestamp: May 03, 2014, 02:54:26 pm
content: There is something like this already for storing bitcoin data I think.

author: tld
author_rank: Regular Contributor
timestamp: May 03, 2014, 03:06:40 pm
content: It sounds like the start of a good idea, but not quite unique or revolutionary. There's also a lot of problems it doesn't solve. If I get a password from the device up on my cellphone screen (or the device itself), then type it in on my PC-keyboard to log in somewhere, and there's a keygrabber on the PC, it'd all be for nothing.If you want to do something like this, I think you'd need to start by defining what you'd like to secure. Your own custom stuff? All passwords?For custom-solutions, you could look into challenge-response setups. For generic solutions, it's a lot harder. You could perhaps do something fancy like having a browser-plugin, doing a login from or through the device, and move any session-cookies back to the browser.(Just some thoughts off of the top of my head)tld

author: 128er
author_rank: Regular Contributor
timestamp: May 03, 2014, 03:22:02 pm
content: Look at hackaday for example:http://hackaday.com/?s=password+keeper

author: Nerull
author_rank: Frequent Contributor
timestamp: May 03, 2014, 03:28:58 pm
content: Most password managers store passwords offline, and your keeper is only more secure than those so long as you never plug it into anything. The device is still vulnerable to the most common methods of password theft.

author: akis
author_rank: Frequent Contributor
timestamp: May 03, 2014, 03:36:39 pm
content: Ah yes that's it, great minds and all that.@tld: ideally we want a pen+paper notebook replacement. What we do with the data is another (security) issue altogether. Keyloggers, trojans, viruses, man-in-the-middle attacks all that is a completely different story of applying the data. If the PC or Android phone cannot be trusted then the onboard LCD option should be used.

author: Nerull
author_rank: Frequent Contributor
timestamp: May 03, 2014, 04:20:21 pm
content: If the PC is compromised than the mere act of reading the password of the screen and typing it in will result in a stolen password. These password keepers give a false sense of security - they make you feel like your passwords are safer, while not doing anything about the methods generally used to steal passwords. At some point your password must be handed over to the system you are trying to log in to, and that point is where passwords are stolen - either through key-logging, phishing, or social engineering.

author: zapta
author_rank: Super Contributor
timestamp: May 03, 2014, 05:07:20 pm
content: I am using this onehttp://news.softpedia.com/news/Mandylion-Password-Manager-Doesn-t-Joke-Around-with-Your-Security-18729.shtmlIt was designed from scratch for security (no firmware, just custom hardware, no electronic output whatsoever, just a display, local generation of random passwords and so on). It comes with a software that allows to manages it but its a one way protocol.

author: tld
author_rank: Regular Contributor
timestamp: May 03, 2014, 05:27:07 pm
content: Quote from: akis on May 03, 2014, 03:36:39 pmBut how does the onboard LCD help you, if you still enter your passwords on phone or PC, which happens to be compromised?Replacing pen+paper could help you from loosing passwords, but you should do backups anyway, so even PC-software would solve that, and the device doesn't really add anything.It also doesn't solve the problem of a compromised PC or cellphone, so it doesn't really add anything there either.I'm not saying you should drop the idea - far from, I'd like to encourage it - but I really think you need to define which problem you're trying to solve a bit more clearly. It's very hard to evaluate a solution towards an undefined problem.That's why I'm just trying to say the idea really demands more thought, and probably some additions (such as pairing it with a challenge/response-system, or browser-hooking for session-management).tld

author: akis
author_rank: Frequent Contributor
timestamp: May 03, 2014, 05:52:27 pm
content: Quote from: Nerull on May 03, 2014, 04:20:21 pmThat is right. You may lose your personal data for a variety of reasons, even someone overhearing your conversations.The idea, my idea, which seems was not very original anyway, is to provide a portable, personal, PC-independent way of storing and retrieving data, to replace say a pen and paper notebook/address book.Versus keeping all your sensitive data on those online "password keeper" web sites or keeping all your data on your email host (google, yahoo etc) which incidentally is something we all do partially at least.The idea that your sensitive data, names, addresses, numbers, locations, documents, copies of emails, accounts, all that can be stored in a way that there is absolutely no middle man, no dependency on some company that promises to keep your data safe, no possibility of hackers, rogue employees or government agents getting to the data.Regardless if you use a piece of paper, a "gadget" or an online password service to retrieve some sensitive data, what happens to the data after that, how you use it and how you might lose it, is a completely different matter.The device suggested above seems to be exactly what I was thinking ofhttp://hackaday.com/?s=password+keeper.Thinking a bit further, we could also use a cheap smartphone or tablet (with internet access disabled) and store everything in there, better than pen+paper, but not encrypted as strongly as a custom made device. The next step would be "how do I make this smaller and how do I encrypt everything on it in case I lose it". I believe Android allows you to encrypt your phone / tablet so maybe it is already doable.

author: akis
author_rank: Frequent Contributor
timestamp: May 03, 2014, 06:16:32 pm
content: Quote from: tld on May 03, 2014, 05:27:07 pmTwo different problems, storing/retrieving (with or without middle man and with or without encryption) and using/applying this sensitive information. I am concentrating on the first problem only.It is true that those 3rd party password keepers try to do everything at once: store your sensitive data (passwords and more), delete stored data from your browser on your PC, auto-fill in forms, protection from trojans and viruses and more. We are now really entering the realm of firewalls, anti-virus systems, anonymous/encrypted browsers, VPNs. And the security of the wifi and network - the list is endless. And to take it further, your own bank may lose your data or get hacked or go bust...What the device adds is the convenience of having all sensitive data in one place, independent of 3rd party companies that promise to store it for me, more secure than a small tablet/smartphone that could be used for the same purpose, completely independent and not reliant on the internet. The LCD, or even better a small screen, would allow you to view/edit your data on that device alone (imagine you need a phone number or a name and you are not near a PC). The ability to interface with a PC / smartphone would allow you to transfer data as a convenience (rather than having to look at one screen and type into another).

author: madires
author_rank: Super Contributor
timestamp: May 03, 2014, 06:46:49 pm
content: Quote from: akis on May 03, 2014, 02:44:20 pmWould the device send decrypted data to the smart phone/tablet/PC? If yes, it would be a bad idea. The unlock feature could be also used by a thief.QuoteThat means, that you have to be able to enter your master password directly into the device. So it will need a keyboard.QuoteNot really, because you forgot about law enforcement of several counties. Customs/border agents or whatever of some countries (not only banana republics) have the right to take the device away from you or copy it's data and ask you for the password. If you don't tell them the password you'll go into jail.

author: tld
author_rank: Regular Contributor
timestamp: May 03, 2014, 07:15:39 pm
content: Quote from: akis on May 03, 2014, 06:16:32 pmI strongly disagree with the suggestion that the device - by itself - would make anything more secure. It would be rather comparable to putting a strong padlock on a cardboard box.In both cases you'd employ a security-device, but it doesn't add any extra secuity, and you're not addressing the issue that is the weakest link (cardboad, or compromised computer).Compare with using password-management software, and backup.With either your device, or password-software, you're screwed if the machine is compromised.With either solution, you don't loose any data if you loose the machine (backup).Like I earlier, I'd really like to encourage you on this, but I do think a re-evaluation would be in order. Look at what you're protecting and how, what's the attack-points and how can you protect against them, how do you secure anything if a PC is compromised, and so on.Challenge-response authentication for example, would allow you to not loose credentials if a pc is compromised, but merely have the session be compromised.tld

author: akis
author_rank: Frequent Contributor
timestamp: May 03, 2014, 08:34:23 pm
content: Quote from: madires on May 03, 2014, 06:46:49 pmI think it would be convenient for the device to be able to send pieces of data to a PC or a to a smartphone - if it can be proven that no matter what is running on the PC the device cannot be hacked backwards. For example the device would not accept any commands from the PC, but would only send to it, by pressing on its own buttons. Something like that.The unlock feature would be there to allow you to retrieve your data if you have forgotten the master password. Something like a second master password perhaps. And even a third one. You'd have to make sure you will not forget all three at the same time.I had not thought about a keyboard, but it could also use some sort of arrow keys like you use your remote control to enter email addresses and password on your Netflix TV. However now I am thinking more of a tiny smartphone with a touch screen, the smallest on the market, that would do the job fine I think, assuming you'd encrypt it. I think Android allows you to encrypt the whole phone, memory contents and all, but I have not used the feature.I am not sure of the various laws in every country but unless you are a wanted criminal I cannot think how anyone can ask you for a password. It's like carrying a piece of paper on you with some scribbles and get arrested if you do not explain the scribbles to the customs officers. I do not think that's an issue. Anyway you could have two or more passwords unlocking various layers of data. Maybe we need legal advice on this, I will ask on lawyers forums to be sure.By the time we have discussed all this, there are already in this thread two such devices, one has an LCD display and arrow keys and the other is CPU controlled. And I am sure there will be software you can put on a smartphone to turn it into a password/data device ?Anyway, I am off to the lawyers forums.