[سغ] تين [هوم بج] [سغ] تين [نوسفيد] [سغ] تين ببريد إلكترونيّ [سغ] تين كثير موقعات شعبيّة
أرقام هامّة
يساعد أنت, ب يساعدبنفسي مع [بلوغّينغ], يستعرض, وتكنولوجيا أطراف

← اضطراب مع فراغي كيف أن يصمّم ك خاصّة المعتدل [ووردبرسّ] موضوع →

حزمة فوق كلمت سرّك مع [بسّبك]

أبريل - نيسان [26ث], 2007 · بدايفيد [بردلي]

[بسّبك] علامة تجاريّة[ترا] علق [كلّي] من passpack.com مؤخّرا على نا كلمة سرّ لعالمات موقعة. قاربت أن يسحب إنتباهك إلى رواية إلى يخزّن كلمت سرّك.

الآن, يتلقّى نحن كلّ يكان من خلال الآلام من يخزّن ويسترجع كلمة سرّ لكلّ أنّ ملايين من [نتوورك ست] اجتماعيّة, [مسبس] نا مختلفة و [يووتثب] يحسب, كلّ شيء من [ديغّ] إلى [هوتديغّدي] حاجات فريدة [أوسرنم] وكلمة سرّ إدماج.

مع كلمت سرّنا لعالمات موقعة, أعطى نحن أنت فكرة على كيف أن يخلق كلمة سرّ قوّيّة, أيّ سيدة كالّي بلطف مدّد فوق ب يقدّم الاقتراح أنّ [رثر ثن] استعملت صيغة وحيد كيميائيّ أنت تضيف زوج الكلمات, [س ثت], [فور ينستنس] [بسّفرس] ك أمكن أصبحت [ك6ه12و6] [روتس] أسن أو شيء قليلا أكثر خفيّة المعنى [أف وهيش] فقط أنت كنت مدركة.

لسوء الحظّ, يترك هذا بعد [ويد وبن] المشكلة من كيف أن يحافظ عروة حلقة على كلّ هذا كلمة سرّ, قوّيّة بما أنّ هم أمكن كنت وأن يتذكّر الذي [أوسرنم] يكون صحبت مع أيّ. هناك حصص من متوفّر على شبكة الإنترنات و [أفّلين] كلمة سرّ مديرات يتوفّر وتقريبا كلّ شخص أنا أعرف بما أنّ [أوسب] تخزين مفتاح هم كلمة سرّ يحمون ضمن أيّ هم استطاع خزّنت قائمة ميلان إلى جانب رئيسيّة من كلمت سرّهم.

يسافر غير أنّ, ماذا إن أنت تنسى ك [أوسب] مفتاح عندما أنت يكون, أو يستطيع لا ينفذ [ستورج ست] خاصّة بسبب [برووسر] تعارض في ك مكتبة أو [سبركف]?

Passpack.com يبدو أن يتلقّى الجوابة. أنت تسجّل مع الموقعة لحرّة (رغم أنّ هو يكون فقط في [بتا], لذلك لا يعتمد على هو 100% صحيحة مع ذلك), يخلق [أوسر-يد], [لوجن] ممر, وبحذق تعليب مفتاح. فقط أرسلت [أوسر-يد] ك إلى الموقعة إلى [لوجن], كلمت سرّك عدّلت [س ثت] هو يكون لا يرسل [بك تو] [بسّبك] في يعرض دولة. [لوجن] بعد ذلك أزندة [دوونلوأد] من ك يشفّر كلمة سرّ محفظة.

يستعمل نص يركض في ال [برووسور] نافذة (بلا [إينفو] يرسل [بك تو] [بسّبك] من هذا مرحلة فصاعدا) بعد ذلك ك تعليب مفتاح أن يفرّغ الحالة في [برووسر ويندوو] ك. هذا يعطي أنت وأنت فقط (ما لم أحد ما يكون أنعم النّظر على كتفك) منفذة إلى تجميعك من [أوسرنم] وكلمة سرّ, كلّ إدماج يصحب مع المناسبة موقعة [أورل].

[س فر], هكذا جيّدة.

يتلقّى يحاول هو زوج الأوقات, هو جدّا يتيح أن يثبت فوق وإستعمال. When you first login you see an array of black squares which are part of a unique anti-phishing mechanism associated with a phrase you get to choose that only you can ever see and that verifies that you are on the passpack system not a spoofed site. “It combines a custom Welcome message, IP recognition and hand-eye training,” Ms Kelly says.

However, I had a seriously nagging feeling that there is something missing from passpack - namely automatic login to your various websites. So, I dropped Tara at Passpack’s head office a line to see what she had to say about this fundamental issue and she came straight back to me, to tell me that this very feature - an auto-login tool - with a Smart Button - that does not rely on plugins is just about to be signed off and released (you can watc a demo here - http://passpack.wordpress.com/2007/03/22/passpack-auto-login-no-plugin-needed/). They’re also adding inline help to the application to make it easier to use. She also told me that, “We have a few small interface improvements almost ready to roll, as well as a few updates that handle some cosmetic issues in Mac Safari.”

The Smart Button is not yet implemented (it has been security validated, but needs some cosmetic fixes), so check back here again soon and I’ll update via the comments on this post so you get to hear as soon as it goes live. As it stands, Passpack just looks like a clever password storage facility with double encryption and a neat line in anti phishing bait. Once the Smart Button is enabled, however, it will steam ahead of the pack.

If you start using Passpack and then change your mind about it, you can always take your data with you. “We support complete export of your data,” Tara told me, “as well as encrypted back up copies.” The developers obviously want users to stay with them because they like the site not simply because of inertia or being locked in.

You can sign up for passpack.com here. Before you ask, no they aren’t paying me to promote the product (10% commission for a free product is $0, after all). It just seems to be a unique approach to a perennial problem that could help you.

6 responses so far ↓

  • Marco Barulli // Apr 26, 2007 at 6:13 pm

    Hi,
    you might also be interested in trying Clipperz.

    Clipperz is an online password manager with some uncommon features:
    - automatic (direct) login to websites
    - offline version
    - …

    To configure automated logins you just need to launch a bookmarklet from the page containing the login form.

    And you are not limited to storing passwords, but any valuable textual information.

    http://beta.clipperz.com

    Please feel free to compare the security level of Clipperz with Passapack’s. (AES 256 instead of 128, SHA2-256 instead of SHA-1 or MD5, a proper PRNG, …). We are also particularly proud of the authentication process based on Stanford SRP protocol. And you need just one password (not two as in Passpack).

    It’s free and completely anonymous.

    The source code is freely available from Clipperz site for security review and the core crypto functions has been released under a BSD license.

    Thanks,
    Marco
    Clipperz co-founder

  • David Bradley // Apr 26, 2007 at 6:47 pm

    Hi Marco

    Thanks for alerting us to this password manager. Is it also browser and OS independent?

  • Marco Barulli // Apr 26, 2007 at 11:44 pm

    Clipperz runs smoothly with every OS and on Firefox, IE and Opera. Safari support coming very soon.

    Thanks,
    Marco

  • Francesco (PassPack) // Apr 27, 2007 at 1:18 am

    @David
    Thanks for this article. It’s nicely done.

    @Marco
    Let me reply to your comments on security, and if I oversimplify, please understand that I’m trying to make this post intelligible for non-crypto readers as well. So bear with me.

    -1-
    AES 128bit is suggested by US Federal Government for Secret documents. AES 256bit takes that further, but it is utterly useless for our scope. PassPack’s AES implementation supports 192bit and 256bit keys but we prefer to use 128bit. Why? Simple. In order to actually obtain a pure 256bit derived key, the user has to write a pass phrase of more then 50 characters. Have you ever met a user that does this? It’s pure theory.

    Just to make the point. I played with the password strength tester that you recently implemented. It reaches it’s maximum strength reading at 128bit (not 256). Don’t worry, it’s not an oversight on your part, it’s just reasonable: there’s no need for more. [wink]

    -2-
    I agree that SHA-1, if used directly, is not so secure because the Chinese have found a way to reverse it. That’s why we don’t use SHA-1 directly, rather we combine it with xxTEA to create a hash. Here’s the formula:

    SHA1Hash(xxTEAencrypt(text, key)).substring(0, 32)

    That’s not reversible.

    -3-
    Tom Wu’s SRP technology is great, and so is PRNG, and generation of entropy is exciting, but honestly - it’s overkill.

    In general, it’s important to remember that PassPack (and Clipperz) need to run in the browser. And browsers speak Javascript. And Javascript is slow. Every choice needs to be carefully weighed to find the right balance between security and speed. That doesn’t mean we choose speed over security - it means we choose balance.

    Here’s an example. My PassPack account contains overs 200 entries, each with a User ID, Password, link, some tags and even notes. Yet, my 3 year old laptop can encrypt my entire pack and save it in 16 seconds (4 of which are added as “downtime” by PassPack itself to avoid stressing the browser). Clipperz employees 6 seconds to encrypt a single card. That’s a substantial difference.

    -4-
    One quick note on PassPack’s Packing Key - it’s what enables us to implement our anti-phishing welcome message. That’s just not possible with a single user/pass combination.

    Security isn’t only about what algorithms you choose.

    Ciao,
    Francesco Sullo
    PassPack Software Architect

  • PassPack's April 2007 Buzz Round up « PassPack - The Blog // May 1, 2007 at 8:18 pm

    […] Pack Up Your Passwords with Passpack | Significant Figures […]

  • PassPack Your Passwords: Get Them Anywhere, Securely and Freely // Aug 13, 2007 at 5:45 am

    […] as the next day — since I stay up past midnight often enough this just makes it easier) I discovered a service called PassPack. The basic premise is this: Create an account, store all your passwords […]

Leave a Comment

Comments are checked for spam before appearing, no need to post it twice.

Related Posts