skylab/MasterPassword
2
0
Fork 0
Code Releases Activity

The x template doesn't use all the symbols from the o template.

Browse Source
This commit is contained in:
Maarten Billemont 2014-08-20 15:22:08 -04:00
parent 60ecd8181e
commit aa60dcfbe4
3 changed files with 19 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Site/2013-05/algorithm.html
View File

@ -276,12 +276,12 @@ passWord[i] = passChar</pre>
<li><code>bcdfghjklmnpqrstvwxyz</code></li>
</ul>
</p></li>
<li><p>Template character: <code>A</code> (<code>= V . C</code>)
<li><p>Template character: <code>A</code>
<ul>
<li><code>AEIOUBCDFGHJKLMNPQRSTVWXYZ</code></li>
</ul>
</p></li>
<li><p>Template character: <code>a</code> (<code>= V . v . C . c</code>)
<li><p>Template character: <code>a</code>
<ul>
<li><code>AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz</code></li>
</ul>
@ -296,9 +296,9 @@ passWord[i] = passChar</pre>
<li><code>@&amp;%?,=[]_:-+*$#!'^~;()/.</code></li>
</ul>
</p></li>
<li><p>Template character: <code>X</code> (<code>= a . n . o</code>)
<li><p>Template character: <code>X</code>
<ul>
<li><code>AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789@&amp;%?,=[]_:-+*$#!'^~;()/.</code></li>
<li><code>AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789!@#$%^&amp;*()</code></li>
</ul>
</p></li>
</ul>

7
Site/2013-05/css/main.css
View File

@ -104,6 +104,13 @@ h2.inline, h3.inline, h4.inline {
.box img {
border: 1px solid white;
}
img.block {
display: block;
border: 1px solid black;
padding: 4px;
margin: auto 1em;
width: 640px;
}
.thumb {
clear: both;

8
Site/2013-05/faq.html
View File

@ -94,9 +94,17 @@
<p>There is an exception: Master Password allows you to save "custom" or "personal" passwords in the app. These passwords don't use Master Password's special algorithm and are merely encrypted using the strong master key derived from your master password. These types of passwords behave more like conventional vault-based passwords do. They are however very well protected and an attacker would still need to find a way to crack your master password (which is extremely
difficult, see below) before being able to decode the passwords in its vault.</p>
<h1 id="surrender">Can an officer force me to divulge my master password?</h1>
<p>Cryptography only provides technical security. It does not protect you from situations where you are legally required or forced by peers to surrender your key.</p>
<img class="block" src="http://imgs.xkcd.com/comics/security.png" />
<p>In fact, many countries provide their officers with a legal grounds for forcing you to divulge your encryption keys to any encrypted information they've recovered during a warranted search.</p>
<p>Again, unlike ordinary password managers, Master Password might have an edge here. If you make no use of stored passwords, Master Password doesn't actually encrypt anything with your master password. That means, when your devices are seized, these legal grounds may no longer apply. Note however that this does not constitute legal advice and that this theory has never been tested in practice.</p>
<p>For your safety, we recommend that in preparation of travelling, you change the master password for your user on the device. That way, if your device is seized by a foreign entity and they force you to divulge your master password, you'll likely be fully compliant by simply giving up the new master password even though it will cause the app to generate invalid passwords for all your sites. Later, you can always change the master password back to the real one.</p>
<h1 id="masterpassword">What should my master password be?</h1>
<p>The simple answer to that question is: First and foremost, memorable and unrelated to you. What that means is that the most important thing about your master password is that you need to be able to recall it any time and yet it should not be derived from anything personal.</p>
<p>That advice usually doesn't help very much with actually picking a good master password. <strong>The goal of a good password is that it'll take an attacker a lot of guesses before he'll find it</strong>. That is the core idea behind good passwords.</p>
<img class="block" src="http://imgs.xkcd.com/comics/password_strength.png" />
<p>There are a few strategies of getting good passwords. The speed with which an attacker can guess your password depends a lot on whether he knows what kind of password you're using or not. So we'll compare a few password strategies, their strength and how memorable they are.</p>
<p>The simplest strategy for picking good passwords is by just picking a bunch of random letters, digits and symbols and mixing them up. This is a great strategy for strong passwords but those passwords are usually not very memorable.</p>
<p>Another strategy is by "encoding" something you already know. This can seem like a good way to make memorable passwords, but recalling the "encoding" you used two years later can be tricky. This also makes it much easier for attackers that know you to find your password.</p>