From d4adafb44848a8256fc331517097e7fc1764c0ff Mon Sep 17 00:00:00 2001
From: Maarten Billemont
Some of you already try to remember unique-ish passwords for different sites. This causes problems too: @@ -158,7 +174,7 @@ or purpose you might need a password for.
-
That's why this application allows you to change the password type to Personal
or Device
@@ -171,15 +187,14 @@
password to one generated by the app, this is as good as it gets.
Absolutely not! In fact, generated passwords aren't even stored on your device. No, not in the cloud either. They're not stored anywhere! What that basically means is, if you grab the iPhone of a - colleague or friend and open this app on it with your own master password, it'll give you all your - generated passwords (don't worry, it's perfectly safe). So, if you lose your iPhone or forget it, - just open the app on your iPad, or borrow a friend's phone, and you're back in business. No backups or - restores needed. + colleague or friend and open this app on it, re-create your user and log in, it'll give you all your + generated passwords. So, if you lose your iPhone or forget it, just open the app on your iPad, + or borrow a friend's device, and you're back in business. No backups or restores needed.
This also means that, unlike all those apps that store your passwords or send them off to be stored on the @@ -187,108 +202,107 @@ get at your passwords. There's also no cloud service that can be mis-managed or hacked.
-Correct. However, remember that usually you'll only need to use this app once for each site. After you log into a site once using the password generated by this app, your browser will probably ask you to remember - the password for the future. Agree to that, and you won't need to bring up your phone again the next time + the password for the future. Agree to that, and you won't need to bring up your device again the next time you log in to the account.
- There is also a Mac version of Master Password available from the App Store. It allows you to - generate any of your passwords without even needing to take out your phone. + There is also a Mac version of Master Password that will be released on the Mac App Store. + It allows you to generate any of your passwords without the need to bring out your device.
-- For starters, make sure you've changed the passwords of all your sites you have accounts for to those - generated by this app and make sure that you use this app when registering a new account somewhere, to - determine the password to use for the account. + The most important aspect to the security of your passwords is your master password. Make sure + you've chosen a long and unique master password. Master Password's algorithm makes it exceedingly + difficult for an attacker to try and guess your master password, but that doesn't make you invulnerable when + your master password is short or easy to guess. Ideally, your master password should be longer than 10 characters. + An absurd sentence is a great idea, especially if you add non-english or gibberish words to it. + Absurd sentences are long and high in entropy, but also particularly easy for the human brain to remember.
- It's also important that you've chosen a long master password. Short master passwords, especially 4-digit
- PIN codes, are trivial to guess by attackers. Using a 10-character master password provides
- sufficient entropy to protect against any modern-day attempt at brute-forcing, assuming the password is not
- based on easily determined facts (names, birth dates, etc.).
+ Armed with a good master password, your next step is to assign generated passwords to all of your sites.
+ By default, Master Password creates passwords that are secure and still easy to copy from your device to a
+ computer by keyboard. If you prefer, you can go into Master Password's preferences (using the top-right icon)
+ and change the default password type to Maximum Security
. Any new sites will now generate
+ passwords that are even higher in entropy. These types of passwords are nigh impossible for an attacker to
+ brute-force (though a Long Password
really is secure enough for most any purpose, see
+ What if a site I use gets hacked?).
- A better idea yet is to use a pass phrase, ideally an absurd sentence. These are usually - much easier to remember and much harder to guess by attackers. -
-
- Using the action icon on the top right, select Settings
to find some advanced settings for
- the application. Here, you can disable Remember my password
. Doing so will force the
- application to ask for your master password each time you open it. That way, when you show your
- phone to somebody else after unlocking it, they can't go through your passwords.
+ Also check out the application's preferences (using the action icon on the top right, select Preferences
).
+ Make sure that Save Password
is disabled. Saving your password is a convenience feature that lets your
+ device save your master password so you don't need to enter it anymore. It also means that if somebody finds your device
+ somewhere or steals it, the only obstacle between them and your passwords are your device's PIN code (assuming you even
+ have one set).
+ If you go into Settings
from the Preferences
page, you'll see some global application settings.
+ Make sure that Stay logged in
is disabled here. If enabled, Master Password will not log you out when you
+ close the app. Your master password isn't saved on your device, but kept in memory for as long as your device remains
+ powered on. Again, a malignent person can easily get to your passwords if they find your device powered on and logged
+ into Master Password.
+ There have been some high-profile password database leaks lately. LinkedIn, eHarmony, Last.fm, to name a few,
+ have lost millions of people's password hashes. In these cases, attackers have obtained a hash
of
+ the passwords of all of these people, which makes it much easier for them to guess their real password.
+ A single sophisticated computer can be used to try about 200 million password combinations per second in an
+ attempt to find the real password behind a hash. That means these millions of people should be really worried
+ about their account's security.
+ However, if your account is protected by a Long Password
generated by Master Password, it would
+ take an attacker with ten sophisticated machines multiple lifetimes to find your actual password from a hash.
+ If the attacker knew beforehand that you had used Master Password to generate your password, he could make
+ his approach smarter and ten sophisticated machines would still take more than a year of constantly trying
+ millions of password combinations to find out your actual password.
+ If instead you used a Maximum Security
password to protect your account, the time it would take
+ for an attacker to brute-force your password goes completely off the scale: 10,000 sophisticated machines
+ would take up to 312409704477000000 years to try and find your password, even if the attacker knew you're
+ using Master Password.
+
+ If you're worried anyway or you need a new password for your site for some other reason, tap the password + counter button (the plus icon) to instantly create a new password for that site. +
++ Long story short: When a website you use gets hacked and your password hashes are revealed to hackers, this + is a big problem for the security of your account, but only if you're not using Master Password. +
+ + +Due to the nature of this app's algorithms and the decisions that were made to protect against brute-force attacks, it is simply infeasible to recover your master password. If you really can't remember it, your passwords are gone.
- Where you go from here is, you log in with a new master password, and for each of your accounts, you go
- through the password recovery procedure (which will usually involve sending a message to your email account)
+ Where you go from here is: on the unlock screen, tap and hold your user. A dialog will pop-up that will allow
+ you to reset your master password. Assign a new master password, log in, and for each of your accounts, go
+ through the password recovery procedure (which will usually involve the site sending a mail to your email account)
and reset the passwords of these accounts to passwords generated by your newly chosen master password.
- Just don't forget it again! :-)
+ Now don't forget it again! :-)
- The way Master Password works internally is fully disclosed. The source code for this application - is also available from GitHub. I invite anyone with a technical background to go through these - resources to make certain of the trustworthyness of Master Password. -
-- This part will likely make sense to you only if you're well versed in computer security jargon. If you're - the kind of person who likes to know how the clock ticks before deciding that it can be trusted to keep - ticking, read on. -
-- The user chooses a single master password, preferably sufficiently long to harden against brute-force - attacks. The application then creates a scrypt key derivative from the user's password. This process - takes quite a bit of processing time and memory. It makes brute-forcing the master password - far more difficult, to practically infeasible, even for otherwise vulnerable password strings. -
-
- When the user requests a password be generated for a site, the application composes a byte buffer
- consisting of the site's name (UTF-8
encoded), the key derived from the master password,
- and a password counter, delimited in that order by a NUL byte. The bytes are hashed using the
- SHA-1
algorithm. The bytes resulting from this hashing operation are called the
- seed
in the next steps.
-
- Next, we need the password type that the user has chosen to use for the site. Password types determine the
- cipher
that will be used to encrypt seed
into a readable password. For
- instance, the standard password type Long Password
activates one of three pre-set ciphers:
- CvcvCvcvnoCvcv
, CvcvnoCvcvCvcv
or CvcvCvcvCvcvno
. Which of those
- will be used, depends on the first of the seed
bytes. Take the byte value modulo the amount of
- pre-set ciphers (in this case, three), and the result tells you which of the three ciphers to use.
-
- Now that we know what cipher to use for building our final password, all that's left is to iterate the
- cipher, and produce a character of password output for each step. When you iterate the cipher, every
- character in the cipher represents a set of possible output characters. For instance, a C
- character in the cipher indicates that we need to choose a capital consonant character. An o
- character in the cipher indicates that we need to choose an other
(symbol) character. Exactly which
- character to choose in that set for the password output depends on the next byte from seed
bytes.
- Like before, take the next unused seed
byte's byte value modulo the amount of characters in the
- set of possible output characters for the cipher iteration and use the result to choose the output
- character. Repeat until you've iterated the whole cipher.
-
- The result is a password whose format is dictated by the password type's ciphers and whose exact value is - filled in by feeding the algorithm some bytes from a hash operation on the user's givens. + The way Master Password works internally is fully disclosed. + The source code for this application is also available from GitHub. + I invite anyone with a technical background to go through these resources to make certain of the trustworthiness of Master Password.
-- Contact me directly for enterprise inquiries. I can provide branded clients and enterprise distribution - if your company is interested in deploying this solution internally. + Contact me directly for enterprise inquiries. + I can provide branded clients and enterprise distribution if your company is interested in deploying this solution internally. +
++ Master Password can also be used as a One-Time Password token generator to secure your infrastructure and client access.