From 395f7c71a2a4284e3dbbe25df7fb7d736f836955 Mon Sep 17 00:00:00 2001 From: Maarten Billemont Date: Thu, 6 Nov 2014 07:48:02 -0500 Subject: [PATCH 01/24] Switch more references to HTTPS. --- Site/2013-05/404.html | 2 +- Site/2013-05/algorithm.html | 13 +++---------- Site/2013-05/faq.html | 21 +++++++-------------- Site/2013-05/index.html | 6 +++--- Site/2013-05/news-dev.html | 21 --------------------- Site/2013-05/news.html | 21 --------------------- Site/2013-05/privacy.html | 13 +++---------- Site/2013-05/security.html | 6 +++--- Site/2013-05/support.html | 13 +++---------- Site/2013-05/trouble.html | 6 +++--- Site/2013-05/what.html | 6 +++--- 11 files changed, 29 insertions(+), 99 deletions(-) delete mode 100644 Site/2013-05/news-dev.html delete mode 100644 Site/2013-05/news.html diff --git a/Site/2013-05/404.html b/Site/2013-05/404.html index 04465441..7f4cc4ef 100755 --- a/Site/2013-05/404.html +++ b/Site/2013-05/404.html @@ -151,7 +151,7 @@ - + diff --git a/Site/2013-05/algorithm.html b/Site/2013-05/algorithm.html index b1d48785..ba10c80a 100644 --- a/Site/2013-05/algorithm.html +++ b/Site/2013-05/algorithm.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + @@ -55,13 +55,6 @@
- -

The Master Password Algorithm

diff --git a/Site/2013-05/faq.html b/Site/2013-05/faq.html index 692ce39f..3b641ec0 100644 --- a/Site/2013-05/faq.html +++ b/Site/2013-05/faq.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + @@ -54,13 +54,6 @@
- -

Security Overview

@@ -94,7 +87,7 @@

Can an officer force me to divulge my master password?

Cryptography only provides technical security. It does not protect you from situations where you are legally required or forced by peers to surrender your key.

- +

In fact, many countries provide their officers with a legal grounds for forcing you to divulge your encryption keys to any encrypted information they've recovered during a warranted search.

Again, unlike ordinary password managers, Master Password might have an edge here. If you make no use of stored passwords, Master Password doesn't actually encrypt anything with your master password. That means, when your devices are seized, these legal grounds may no longer apply. Note however that this does not constitute legal advice and that this theory has never been tested in practice.

For your safety, we recommend that in preparation of travelling, you change the master password for your user on the device. That way, if your device is seized by a foreign entity and they force you to divulge your master password, you'll likely be fully compliant by simply giving up the new master password even though it will cause the app to generate invalid passwords for all your sites. Later, you can always change the master password back to the real one.

@@ -102,7 +95,7 @@

What should my master password be?

The simple answer to that question is: First and foremost, memorable and unrelated to you. What that means is that the most important thing about your master password is that you need to be able to recall it any time and yet it should not be derived from anything personal.

That advice usually doesn't help very much with actually picking a good master password. The goal of a good password is that it'll take an attacker a lot of guesses before he'll find it. That is the core idea behind good passwords.

- +

There are a few strategies of getting good passwords. The speed with which an attacker can guess your password depends a lot on whether he knows what kind of password you're using or not. So we'll compare a few password strategies, their strength and how memorable they are.

The simplest strategy for picking good passwords is by just picking a bunch of random letters, digits and symbols and mixing them up. This is a great strategy for strong passwords but those passwords are usually not very memorable.

Another strategy is by "encoding" something you already know. This can seem like a good way to make memorable passwords, but recalling the "encoding" you used two years later can be tricky. This also makes it much easier for attackers that know you to find your password.

@@ -151,7 +144,7 @@ Difficult - Encoding a word, Tr0ub4dor style + Encoding a word, Tr0ub4dor style Tr0ub4dor @@ -169,7 +162,7 @@ Moderate - Nonsense sentence, correct horse style + Nonsense sentence, correct horse style correct horse battery staple diff --git a/Site/2013-05/index.html b/Site/2013-05/index.html index 126ff59f..84be9266 100644 --- a/Site/2013-05/index.html +++ b/Site/2013-05/index.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + diff --git a/Site/2013-05/news-dev.html b/Site/2013-05/news-dev.html deleted file mode 100644 index 59085c74..00000000 --- a/Site/2013-05/news-dev.html +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - -

- - diff --git a/Site/2013-05/news.html b/Site/2013-05/news.html deleted file mode 100644 index d44cc776..00000000 --- a/Site/2013-05/news.html +++ /dev/null @@ -1,21 +0,0 @@ - - - - - - - -

Open support if you have any issues.

- - diff --git a/Site/2013-05/privacy.html b/Site/2013-05/privacy.html index 1092216b..630adb7b 100644 --- a/Site/2013-05/privacy.html +++ b/Site/2013-05/privacy.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + @@ -55,13 +55,6 @@
- -

Privacy Policy

diff --git a/Site/2013-05/security.html b/Site/2013-05/security.html index 6d1cde5e..1aad4e6e 100644 --- a/Site/2013-05/security.html +++ b/Site/2013-05/security.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + diff --git a/Site/2013-05/support.html b/Site/2013-05/support.html index 7b49744e..4fcb6816 100644 --- a/Site/2013-05/support.html +++ b/Site/2013-05/support.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + @@ -55,13 +55,6 @@
- -

Support

diff --git a/Site/2013-05/trouble.html b/Site/2013-05/trouble.html index 51d63b1e..fc45c2da 100644 --- a/Site/2013-05/trouble.html +++ b/Site/2013-05/trouble.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + diff --git a/Site/2013-05/what.html b/Site/2013-05/what.html index abb40c52..0cd75a58 100644 --- a/Site/2013-05/what.html +++ b/Site/2013-05/what.html @@ -1,11 +1,11 @@ - + Master Password — Secure your life, forget your passwords. - + @@ -19,7 +19,7 @@ - + From 435d72a5093354057720563011fc4fa845db6203 Mon Sep 17 00:00:00 2001 From: Maarten Billemont Date: Mon, 10 Nov 2014 12:35:31 -0500 Subject: [PATCH 02/24] Read the user's name and site name from stdin if not given. --- MasterPassword/C/mpw.c | 31 +++++++++++++++++++++++-------- 1 file changed, 23 insertions(+), 8 deletions(-) diff --git a/MasterPassword/C/mpw.c b/MasterPassword/C/mpw.c index 13994a09..ea286d12 100644 --- a/MasterPassword/C/mpw.c +++ b/MasterPassword/C/mpw.c @@ -95,13 +95,24 @@ char *homedir(const char *filename) { return homefile; } +char *getlinep(const char *prompt) { + char *buf = NULL; + size_t bufSize = 0; + ssize_t lineSize; + fprintf(stderr, "%s", prompt); + fprintf(stderr, " "); + if ((lineSize = getline(&buf, &bufSize, stdin)) < 0) { + free(buf); + return NULL; + } + buf[lineSize - 1]=0; + return buf; +} + int main(int argc, char *const argv[]) { - if (argc < 2) - usage(); - // Read the environment. - const char *userName = getenv( MP_env_username ); + char *userName = getenv( MP_env_username ); const char *masterPassword = NULL; const char *siteName = NULL; MPElementType siteType = MPElementTypeGeneratedLong; @@ -156,13 +167,17 @@ int main(int argc, char *const argv[]) { // Convert and validate input. if (!userName) { - fprintf(stderr, "Missing user name.\n"); - return 1; + if (!(userName = getlinep("Your user name:"))) { + fprintf(stderr, "Missing user name.\n"); + return 1; + } } trc("userName: %s\n", userName); if (!siteName) { - fprintf(stderr, "Missing site name.\n"); - return 1; + if (!(siteName = getlinep("Site name:"))) { + fprintf(stderr, "Missing site name.\n"); + return 1; + } } trc("siteName: %s\n", siteName); if (siteCounterString) From f0fa350e64e5e29cceb3bdffdd197d4038783e6e Mon Sep 17 00:00:00 2001 From: Maarten Billemont Date: Mon, 10 Nov 2014 16:44:37 -0500 Subject: [PATCH 03/24] Fix mixed content and bad path for setImmediate-polyfill. --- Site/mpw-js/css/main.css | 2 +- Site/mpw-js/js/dependencies.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Site/mpw-js/css/main.css b/Site/mpw-js/css/main.css index ed0a108f..336855b9 100644 --- a/Site/mpw-js/css/main.css +++ b/Site/mpw-js/css/main.css @@ -1,4 +1,4 @@ -@import url(http://fonts.googleapis.com/css?family=Flamenco:300|Exo+2:400,100,900); +@import url(://fonts.googleapis.com/css?family=Flamenco:300|Exo+2:400,100,900); /**** BASE STYLE ****/ html { diff --git a/Site/mpw-js/js/dependencies.js b/Site/mpw-js/js/dependencies.js index 0d54f51c..ebd155ea 100644 --- a/Site/mpw-js/js/dependencies.js +++ b/Site/mpw-js/js/dependencies.js @@ -37,7 +37,7 @@ try { ES6 || document.write("