Merge branch 'master' of github.com:Lyndir/MasterPassword
This commit is contained in:
Maarten Billemont
commit
2aebcadf70
@ -40,10 +40,10 @@
|
||||
<li><a href="faq.html">FAQ</a></li>
|
||||
<li class="active"><a href="algorithm.html">Algorithm</a></li>
|
||||
<li><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -76,7 +76,7 @@
|
||||
<div class="thumb clearfix">
|
||||
<p><b>Master Password is <em>an algorithm used to generate unique passwords</em></b> for websites, email accounts, or anything else <em>based only on easily reproducible input</em>.<br />
|
||||
The goal is a process that avoids all the problems involved with other password solutions.</p>
|
||||
<p>The Master Password algorithm is <i>open</i>: this page describes its inner workings in detail. We believe the following is an important lesson we should all learn: Regardless of how much encryption a solution claims, <a href="http://www.geekzone.co.nz/foobar/5823">if you don't know how it works, you <strong>cannot</strong> assume it is secure</a> (at least, not the kind of secure you care about).</p>
|
||||
<p>The Master Password algorithm is <i>open</i>: this page describes its inner workings in detail. We believe the following is an important lesson we should all learn: Regardless of how much encryption a solution claims, <a href="http://www.geekzone.co.nz/foobar/5823" onclick="_gaq.push(['_trackPageview', '/outbound/skype']);">if you don't know how it works, you <strong>cannot</strong> assume it is secure</a> (at least, not the kind of secure you care about).</p>
|
||||
|
||||
<h1>The Password Problem</h1>
|
||||
<img class="pull-right" src="img/thumb-authenticate.png" />
|
||||
@ -168,7 +168,7 @@ dkLen = 64</pre>
|
||||
<h1>The Template Seed</h1>
|
||||
<p>With the master <code>key</code> known, we can proceed to calculate a template <code>seed</code> for the site. The template <code>seed</code> is essentially the site-specific secret in binary form.</p>
|
||||
<p>To generate the template <code>seed</code>, we construct an authentication code for the site's <code>name</code> and <code>counter</code> using the user's master <code>key</code>.</p>
|
||||
<p>We employ the <a href="https://tools.ietf.org/html/rfc4868">HMAC-SHA-256</a> algorithm to obtain a large enough <code>seed</code> for the encoding step that follows.</p>
|
||||
<p>We employ the <a href="https://tools.ietf.org/html/rfc4868" onclick="_gaq.push(['_trackPageview', '/outbound/sha-256']);">HMAC-SHA-256</a> algorithm to obtain a large enough <code>seed</code> for the encoding step that follows.</p>
|
||||
|
||||
<pre>seed = hmac-sha256( key, "com.lyndir.masterpassword" . site name length . site name . counter )</pre>
|
||||
|
||||
@ -285,12 +285,12 @@ passWord[i] = passChar</pre>
|
||||
<li><code>bcdfghjklmnpqrstvwxyz</code></li>
|
||||
</ul>
|
||||
</p></li>
|
||||
<li><p>Template character: <code>A</code> (<code>= V . C</code>)
|
||||
<li><p>Template character: <code>A</code>
|
||||
<ul>
|
||||
<li><code>AEIOUBCDFGHJKLMNPQRSTVWXYZ</code></li>
|
||||
</ul>
|
||||
</p></li>
|
||||
<li><p>Template character: <code>a</code> (<code>= V . v . C . c</code>)
|
||||
<li><p>Template character: <code>a</code>
|
||||
<ul>
|
||||
<li><code>AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz</code></li>
|
||||
</ul>
|
||||
@ -305,9 +305,9 @@ passWord[i] = passChar</pre>
|
||||
<li><code>@&%?,=[]_:-+*$#!'^~;()/.</code></li>
|
||||
</ul>
|
||||
</p></li>
|
||||
<li><p>Template character: <code>X</code> (<code>= a . n . o</code>)
|
||||
<li><p>Template character: <code>X</code>
|
||||
<ul>
|
||||
<li><code>AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789@&%?,=[]_:-+*$#!'^~;()/.</code></li>
|
||||
<li><code>AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789!@#$%^&*()</code></li>
|
||||
</ul>
|
||||
</p></li>
|
||||
</ul>
|
||||
@ -318,8 +318,8 @@ passWord[i] = passChar</pre>
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
@ -104,6 +104,13 @@ h2.inline, h3.inline, h4.inline {
|
||||
.box img {
|
||||
border: 1px solid white;
|
||||
}
|
||||
img.block {
|
||||
display: block;
|
||||
border: 1px solid black;
|
||||
padding: 4px;
|
||||
margin: auto 1em;
|
||||
width: 640px;
|
||||
}
|
||||
|
||||
.thumb {
|
||||
clear: both;
|
||||
|
||||
@ -40,10 +40,10 @@
|
||||
<li class="active"><a href="faq.html">FAQ</a></li>
|
||||
<li><a href="algorithm.html">Algorithm</a></li>
|
||||
<li><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -94,9 +94,17 @@
|
||||
<p>There is an exception: Master Password allows you to save "custom" or "personal" passwords in the app. These passwords don't use Master Password's special algorithm and are merely encrypted using the strong master key derived from your master password. These types of passwords behave more like conventional vault-based passwords do. They are however very well protected and an attacker would still need to find a way to crack your master password (which is extremely
|
||||
difficult, see below) before being able to decode the passwords in its vault.</p>
|
||||
|
||||
<h1 id="surrender">Can an officer force me to divulge my master password?</h1>
|
||||
<p>Cryptography only provides technical security. It does not protect you from situations where you are legally required or forced by peers to surrender your key.</p>
|
||||
<img class="block" src="http://imgs.xkcd.com/comics/security.png" />
|
||||
<p>In fact, many countries provide their officers with a legal grounds for forcing you to divulge your encryption keys to any encrypted information they've recovered during a warranted search.</p>
|
||||
<p>Again, unlike ordinary password managers, Master Password might have an edge here. If you make no use of stored passwords, Master Password doesn't actually encrypt anything with your master password. That means, when your devices are seized, these legal grounds may no longer apply. Note however that this does not constitute legal advice and that this theory has never been tested in practice.</p>
|
||||
<p>For your safety, we recommend that in preparation of travelling, you change the master password for your user on the device. That way, if your device is seized by a foreign entity and they force you to divulge your master password, you'll likely be fully compliant by simply giving up the new master password even though it will cause the app to generate invalid passwords for all your sites. Later, you can always change the master password back to the real one.</p>
|
||||
|
||||
<h1 id="masterpassword">What should my master password be?</h1>
|
||||
<p>The simple answer to that question is: First and foremost, memorable and unrelated to you. What that means is that the most important thing about your master password is that you need to be able to recall it any time and yet it should not be derived from anything personal.</p>
|
||||
<p>That advice usually doesn't help very much with actually picking a good master password. <strong>The goal of a good password is that it'll take an attacker a lot of guesses before he'll find it</strong>. That is the core idea behind good passwords.</p>
|
||||
<img class="block" src="http://imgs.xkcd.com/comics/password_strength.png" />
|
||||
<p>There are a few strategies of getting good passwords. The speed with which an attacker can guess your password depends a lot on whether he knows what kind of password you're using or not. So we'll compare a few password strategies, their strength and how memorable they are.</p>
|
||||
<p>The simplest strategy for picking good passwords is by just picking a bunch of random letters, digits and symbols and mixing them up. This is a great strategy for strong passwords but those passwords are usually not very memorable.</p>
|
||||
<p>Another strategy is by "encoding" something you already know. This can seem like a good way to make memorable passwords, but recalling the "encoding" you used two years later can be tricky. This also makes it much easier for attackers that know you to find your password.</p>
|
||||
@ -145,7 +153,7 @@
|
||||
<td>Difficult</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th colspan="4">Encoding a word, <a href="http://xkcd.com/936/">Tr0ub4dor</a> style</th>
|
||||
<th colspan="4">Encoding a word, <a href="http://xkcd.com/936/" onclick="_gaq.push(['_trackPageview', '/outbound/xkcd/troubador']);">Tr0ub4dor</a> style</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>Tr0ub4dor</code></td>
|
||||
@ -163,7 +171,7 @@
|
||||
<td>Moderate</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<th colspan="4">Nonsense sentence, <a href="http://xkcd.com/936/">correct horse</a> style</th>
|
||||
<th colspan="4">Nonsense sentence, <a href="http://xkcd.com/936/" onclick="_gaq.push(['_trackPageview', '/outbound/xkcd/correct-horse']);">correct horse</a> style</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code>correct horse battery staple</code></td>
|
||||
@ -206,7 +214,7 @@
|
||||
<h1 id="numbers">What is the basis for your numbers?</h1>
|
||||
<p>The time-to-crack numbers throughout this website are based on the following assumptions:</p>
|
||||
<ul>
|
||||
<li>The attacker can calculate <code>1 479 million</code> SHA-256 hashes per second (<a href="http://hashcat.net/oclhashcat/">hashcat on AMD HD 6990</a>)</li>
|
||||
<li>The attacker can calculate <code>1 479 million</code> SHA-256 hashes per second (<a href="http://hashcat.net/oclhashcat/" onclick="_gaq.push(['_trackPageview', '/outbound/hashcat']);">hashcat on AMD HD 6990</a>)</li>
|
||||
<li>The attacker can calculate <code>3.3</code> Master Password passwords per second (2GHz MacBook Pro, scrypt N=32768, r=8, p=2, dkLen=64).</li>
|
||||
</ul>
|
||||
</div>
|
||||
@ -220,8 +228,8 @@
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
@ -40,10 +40,10 @@
|
||||
<li><a href="faq.html">FAQ</a></li>
|
||||
<li><a href="algorithm.html">Algorithm</a></li>
|
||||
<li><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -62,7 +62,7 @@
|
||||
<h2>Secure your life, forget your passwords.</h2>
|
||||
</div>
|
||||
|
||||
<div class="box effect-8" onclick="$(this).toggleClass('active')">
|
||||
<div class="box effect-8" onclick="$(this).toggleClass('active');_gaq.push(['_trackPageview', '/video/yt/QTfA0O7YnHQ']);">
|
||||
<div class="minimized">
|
||||
<img class="fit-height" src="http://i.vimeocdn.com/video/318668169_960.jpg" />
|
||||
<div class="middle play"></div>
|
||||
@ -106,7 +106,8 @@
|
||||
<h1>Nothing To Intercept</h1>
|
||||
<p>Master Password is based on a stateless algorithm which frees it from the reliance on storage of secrets.</p>
|
||||
<p>Since your generated passwords aren't saved to your device, there is <strong>no risk you'll be forced to divulge them to aggressive peers</strong>. And since these passwords don't need to be backed up or synchronized between devices over the network, there is <strong>no risk of them getting intercepted</strong>.</p>
|
||||
<p>Finally, Master Password is <a href="http://github.com/Lyndir/MasterPassword/">free software (GPLv3)</a>, its algorithm <a href="/algorithm.html">extensively documented</a> and does not require you to trust any external party. This is particularly interesting in a society where things like <a href="http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data">PRISM</a> and <a href="http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email">gag orders</a> are a real threat.</p>
|
||||
<p>Finally, Master Password is <a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">free software (GPLv3)</a>, its algorithm <a href="/algorithm.html">extensively documented</a> and does not require you to trust any external party. This is particularly interesting in a society where things like <a href="http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data"
|
||||
onclick="_gaq.push(['_trackPageview', '/outbound/prism']);">PRISM</a> and <a href="http://www.theguardian.com/commentisfree/2014/may/20/why-did-lavabit-shut-down-snowden-email" onclick="_gaq.push(['_trackPageview', '/outbound/gag']);">gag orders</a> are a real threat.</p>
|
||||
</div>
|
||||
|
||||
<div class="thumb clearfix">
|
||||
@ -131,8 +132,8 @@
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
@ -40,10 +40,10 @@
|
||||
<li><a href="faq.html">FAQ</a></li>
|
||||
<li><a href="algorithm.html">Algorithm</a></li>
|
||||
<li class="active"><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -95,8 +95,8 @@
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
@ -40,10 +40,10 @@
|
||||
<li><a href="faq.html">FAQ</a></li>
|
||||
<li><a href="algorithm.html">Algorithm</a></li>
|
||||
<li><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -170,7 +170,7 @@
|
||||
|
||||
<h3 class="inline">Master Password solves the <em>strong passwords</em> problem</h3>
|
||||
<p>by generating passwords for you with extremely high entropy. We've found that humans are exceedingly bad at coming up with good passwords, especially when they need a new one every week for a new site they sign up with. Master Password therefore takes the guesswork out of it and generates high-entropy, memorable passwords. High entropy means that when a hacker obtains all of <a
|
||||
href="http://www.washingtonpost.com/business/technology/linkedin-eharmony-deal-with-breach-aftermath/2012/06/07/gJQAwqs5KV_story.html">LinkedIn's password hashes</a>
|
||||
href="http://www.washingtonpost.com/business/technology/linkedin-eharmony-deal-with-breach-aftermath/2012/06/07/gJQAwqs5KV_story.html" onclick="_gaq.push(['_trackPageview', '/outbound/linkedin']);">LinkedIn's password hashes</a>
|
||||
again, they won't be able to brute-force your real LinkedIn password from it.</p>
|
||||
<p>If you used an evenly distributed custom 8-character alphanumeric password (<code>p4sSw0rD</code> doesn't count), it would only take a powerful attacker <em>1.7 days</em> to brute-force your password from a leaked hash. If you used Master Password's default <em>Long Password</em> instead, it would take that same attacker <em>1.4 years</em> of non-stop focus on your password, assuming they already know you used Master Password. If they don't,
|
||||
that time goes up to <em>26 billion years</em>. If you used Master Password's <em>Maximum Security</em> type, it would take up to <strong>422460722753999994880 years</strong>.</p>
|
||||
@ -217,11 +217,11 @@
|
||||
|
||||
<h3 class="inline">Master Password minimizes the parties</h3>
|
||||
<p>you need to trust by implementing a completely stateless solution that requires <em>no storage</em> (you don't need to trust your hard disk or hardware), requires <em>no backups or syncing</em> (you don't need to trust that all your passwords are safely backed up and synced across your devices so they're actually available to you), requires <em>no cloud services</em> (you don't need to trust that your Internet connection is safe, or a cloud provider won't lose your
|
||||
data or <a href="http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data">secretly send it to your or a foreign government</a>).
|
||||
data or <a href="http://www.guardian.co.uk/world/2013/jun/06/us-tech-giants-nsa-data" onclick="_gaq.push(['_trackPageview', '/outbound/prism']);">secretly send it to your or a foreign government</a>).
|
||||
|
||||
<h3>Trust is the most common failure point.</h3>
|
||||
<p>Most other solutions that get strength right don't care so much about the trust front. They figure, if you're going to pay them for their app, you might as well trust them with all your passwords too. This really shouldn't be an implicit assumption. They're <strong>your passwords</strong>, and nobody else should have a say.</p>
|
||||
<p>Knowing what happened to <a href="http://www.pcworld.com/article/2046264/after-lavabit-silent-circle-also-shuts-down-email-service.html">Silent Circle and Lavabit</a>, knowing how extremely powerful and persuasive governments and share-holders can be, you would be well advised to consider very carefully giving the keys to your digital identity to a separate entity.</p>
|
||||
<p>Knowing what happened to <a href="http://www.pcworld.com/article/2046264/after-lavabit-silent-circle-also-shuts-down-email-service.html" onclick="_gaq.push(['_trackPageview', '/outbound/lavabit']);">Silent Circle and Lavabit</a>, knowing how extremely powerful and persuasive governments and share-holders can be, you would be well advised to consider very carefully giving the keys to your digital identity to a separate entity.</p>
|
||||
</div>
|
||||
|
||||
<div class="hlvl">
|
||||
@ -407,8 +407,8 @@
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
@ -40,10 +40,10 @@
|
||||
<li><a href="faq.html">FAQ</a></li>
|
||||
<li><a href="algorithm.html">Algorithm</a></li>
|
||||
<li class="active"><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -90,20 +90,20 @@
|
||||
|
||||
<div class="thumb clearfix">
|
||||
<h1>Feedback Forums</h1>
|
||||
<p>Please see the <a href="http://support.lyndir.com/forum/13031-master-password/">support forums</a> for answers to issues and questions or to open your own topic.</p>
|
||||
<p>Please see the <a href="http://support.lyndir.com/forum/13031-master-password/" onclick="_gaq.push(['_trackPageview', '/outbound/support']);">support forums</a> for answers to issues and questions or to open your own topic.</p>
|
||||
</div>
|
||||
|
||||
<div class="thumb clearfix">
|
||||
<h1>Email</h1>
|
||||
<p>If you'd prefer to talk via email, send us a message at <a href="mailto:masterpassword@lyndir.com">masterpassword@lyndir.com</a> instead. You should get a personal reply within the hour if not in minutes.</p>
|
||||
<p>If you'd prefer to talk via email, send us a message at <a href="mailto:masterpassword@lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/email']);">masterpassword@lyndir.com</a> instead. You should get a personal reply within the hour if not in minutes.</p>
|
||||
</div>
|
||||
|
||||
</div></section>
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
@ -40,10 +40,10 @@
|
||||
<li><a href="faq.html">FAQ</a></li>
|
||||
<li><a href="algorithm.html">Algorithm</a></li>
|
||||
<li class="active"><a href="support.html">Support</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/">Source (GPL)</a></li>
|
||||
<li><a href="http://github.com/Lyndir/MasterPassword/" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">Source (GPL)</a></li>
|
||||
</ul>
|
||||
<ul class="nav pull-right">
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword">#masterpassword (freenode)</a></li>
|
||||
<li><a href="irc://irc.freenode.net/#masterpassword" onclick="_gaq.push(['_trackPageview', '/outbound/irc']);">#masterpassword (freenode)</a></li>
|
||||
<li class="divider-vertical"></li>
|
||||
<li><a href="MasterPassword_PressKit.zip" onclick="_gaq.push(['_trackPageview', '/outbound/presskit']);">⬇ Press Kit</a></li>
|
||||
<li><a href="http://itunes.apple.com/app/id510296984" onclick="goog_report_conversion('index-fixed-header');_gaq.push(['_trackPageview', '/outbound/itunes']);" class="img"><img src="img/appstore.svg" /></a></li>
|
||||
@ -146,8 +146,8 @@
|
||||
|
||||
<footer><div class="muted content">
|
||||
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com">Maarten Billemont</a>, <a href="http://www.lyndir.com">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com">Gorillas</a> ● <a href="http://deblock.lyndir.com">DeBlock</a> ● <a href="http://github.com/Lyndir">GitHub</a> ● <a href="http://thanks.lhunath.com">Send Thanks</a></p>
|
||||
<p><em>Master Password is a security product and algorithm by <a href="http://www.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/lhunath']);">Maarten Billemont</a>, <a href="http://www.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/lyndir']);">Lyndir</a> (© 2011-2013).</em></p>
|
||||
<p><a href="http://gorillas.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/gorillas']);">Gorillas</a> ● <a href="http://deblock.lyndir.com" onclick="_gaq.push(['_trackPageview', '/outbound/deblock']);">DeBlock</a> ● <a href="http://github.com/Lyndir" onclick="_gaq.push(['_trackPageview', '/outbound/github']);">GitHub</a> ● <a href="http://thanks.lhunath.com" onclick="_gaq.push(['_trackPageview', '/outbound/thanks']);">Send Thanks</a></p>
|
||||
|
||||
</div></footer>
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user