16 ms·

Show HN: Forgiva – Never saves your passwords but regenerates them

97 points by marcusfrex 10y ago

Fightback 10y ago
Cool idea, but the main gripe I have with it is that the passwords it generates are clearly not made for remembering, but regenerating them takes multiple seconds.
SNvD7vEJ 10y ago
How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage problems with highly secure way. What does that even mean?
- marcusfrex 10y ago
  >> How does this compare, for example, to the KeePass family of pw-managers? It is a password manager too but with an alternative approach. >> "Fixes poor passwords, accessibility and storage problems with highly secure way." >> What does that even mean? Generates strong passwords by default, you can access them anywhere with it and does not need to store anywhere.
  - SNvD7vEJ 10y ago
    Ok, cool that you can access it anywhere.
  - ComodoHacker 10y ago
    >you can access them anywhere with it and does not need to store anywhere But you have to carry the database with you anyway and have to store somewhere. So what's the point of having database with everything but passwords? And you still need the database encrypted, because you don't want to give the attacker your usernames, emails, recovery answers and other stuff, do you?
    - SNvD7vEJ 10y ago
      Maybe the point is that you do not need to store the database securely, that you can store it openly, as long as the certificate used to generate the passwords is kept secret. But you probably want to keep the meta info of what sites you have access to secret to. So I don't know why this is better than simply use the certificate to encrypt the database. But maybe I did not understand how it works.
- buro9 10y ago
  The way I read it... it's a password manager that doesn't store passwords (centrally or locally). Instead it regenerates the password each time. i.e. password for HN may be: some trait of HN (domain?) + some salt + your identity (cert?) to always produce the same password. I didn't understand it all from the site, the explanations and broken English didn't really elucidate. But... if my understanding was right, I wondered about how to handle cert changes or key rolling, etc. There seemed to be a mentioned mechanism for this, but again I didn't really understand that from the description. Gist though: No generated and stored passwords, but a pattern to always generate the same password for a given site.
  - SNvD7vEJ 10y ago
    Seems like a really cool idea, as long as the password generator can be proved to be hard enough to break. How long does the retrieval of a password take? Sub-second? 10 seconds?
  - cauterized 10y ago
    What happens then if you want/need to rotate your password? How does it deal with stupid password format restrictions?
    - RubyPinch 10y ago
      the salt gets changed so, either password database + master password gets stolen, or salt database + master password gets stolen
      - jjnoakes 10y ago
        Except if the master db is stolen without the master password, one can throw guessed passwords at it and know when one worked (i.e. the db becomes readable). Throwing passwords at a salt db gets you... what?
      - cauterized 10y ago
        But then if the salt is stored and the algorithm is known, doesn't the salt just essentially become the password, from a security standpoint?
- dom96 10y ago
  It looks like it isn't completely closed source, https://github.com/sceptive/Forgiva https://github.com/sceptive/Forgiva.
  - mynameislegion 10y ago
    NC licenses aren't considered "Open Source": http://www.opensource.org/docs/osd http://www.opensource.org/docs/osd
    - dom96 10y ago
      Interesting, but then what do you call something who's source is available to be viewed?
      - dsr_ 10y ago
        "Source-viewable"
      - cyphar 10y ago
        I'd call it proprietary. It's closer to free software, but it's not all the way there.
      - mynameislegion 10y ago
        I call that source code publication or public source code.
    - type0 10y ago
      Then this company - Sceptive is kinda Deceptive. It says on their web page: "Or clone Open Source implementation from Github"
tluyben2 10y ago
I was planning to write one as I do not like existing ones but time is a slight issue: without versions for all platforms and some way to keep them in sync it is hard to switch...
Walkman 10y ago
These security experts forgot one really important thing: usability. I'm not going to wait minutes for one password to generate!
max_ 10y ago
Does this implement Shamir's Secret Sharing?
- marcusfrex 10y ago
  No. Why should it?
  - max_ 10y ago
    added layer of security
dsego 10y ago
I use getvau.lt, how does this compare?
- marcusfrex 10y ago
  Same strategy but Forgiva doesn't just use one key derivation algorithm (such as PBKDF2) but plus various hashing and encryption algorithms too. And at the same time you may forget the options you used in Vault, it is not an option in Forgiva.
  - icebraining 10y ago
    plus various hashing and encryption algorithms too. Is there any evidence that using multiple algorithms has any benefit over simply increasing the cost factor on one?
    - RubyPinch 10y ago
      assuming combined correctly A( B( C(X) ) ), if A becomes broken in the future, its still B( C(X) ), as opposed to just revealing X straight away
      - marcusfrex 10y ago
        Yes, definitely you are right. And at the same time using various other methods "depending on the master key" makes it impossible for an accurate time and process estimation for brute-force attacks.
blowski 10y ago
As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when I need them I'm currently really happy with 1Password on both counts, and I don't really understand why I should move. A competitor would need to establish that they are at least as secure as 1Password, and this landing page doesn't do that at all. For all I know, it's been built by a nefarious hacker or some junior Node.js developer who's just discovered security. Has it been audited? What is the roadmap for the project? These things are much more important than some technical explanation that I didn't really understand.
- freakz 10y ago
  from the About page: "Well respected, international company based on Istanbul which works only with underground talents.Hacks big corporations for good and creates trusted relationships and work hard to protect them against Sith Lords. Helps companies to strengthen their security layers and provides educational services."
- marcusfrex 10y ago
  Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case. Forgiva is actually big brother of kyle (https://github.com/esurharun/kyle https://github.com/esurharun/kyle) which has been at use for nearly 2 years and experienced and tested a lot. Yes, you are definitely right on that we should put roadmap on webpage. And no we are nor "nefarious" hackers neither junior NodeJS developers. :)
  - danieldk 10y ago
    Theoretically stored passwords are not safe at all. What does this even mean? Aren't they as safe as the cryptography being used (key derivation scheme, encryption method, etc.)? (Of course, if a machine is compromised with a keylogger, it's pretty much game over anyway. Unless you use a hardware authentication token.)
    - 10y ago
SpendBig 10y ago
Your password will never be secure when you store it on someone else his disk or let someone else encrypt your password. Its not a matter of how, but when there will be a way to retreive those passwords by anything but you. And its not just that, everything you use your passwords for these days, is stored on some sort of storage in a cloudy architecture. Scattered all over the world in thousands of datacenters. You probably are currently trusting thousands of people working over there, but you dont even know these guys. Terrible imho..
- SNvD7vEJ 10y ago
  What do you mean? This solution does not store passwords at all, if I understand it correctly. So whining about storing them on "someone else disk" is a bit odd, don't you think?
  - SpendBig 10y ago
    In the overview, it says on cloud or local. Which made me think, why would you even suggest storing this on a cloudy device when your offering a password manager.
    - icebraining 10y ago
      In the overview, it says on cloud or local. Where? I don't see "cloud" anywhere on that page..?
    - Klathmon 10y ago
      Why would offering cloud storage as an option be a problem if you don't use it? Some people value usability over absolute security.
- BrandoElFollito 10y ago
  You are right. Only after having reviewed the code for the OS (and before that reverse - engineered the BIOS firmware), recompiled it yourself and then reviewed & recompiled keepass can you state that you are safe. This is the recommended way to go for the standard user to have his passwords safely stored. The alternative to trust a well - established company with your Tinder or gmail password is unthinkable.
amingilani 10y ago
Semi OT, I wrote this satircal piece on how passwords are dead yesterday: https://news.ycombinator.com/item?id=12613433 https://news.ycombinator.com/item?id=12613433
tf2manu994 10y ago
What would happen if the site's domain changes? Or my email changes? Or something else about the metadata changes? Now what if this happens on a site where you can not reset passwords, such as blockchain.info, am I SOL? I like storing passwords becuase I have 100% certainty that it won't just magically generate the wrong one.
huxflux2003 10y ago
No mobile apps?
- marcusfrex 10y ago
  Upcoming. And planning to make it available as Telegram Bot.
arthurfm 10y ago
> To crack a password with 70 bit entropy on a MacBook Pro Early 2013 it will take ~6 million years to complete all combinations on Normal complexity. On Intermediate complexity it will take ~24 million years and on Advanced complexity it will take ~280 million years to reach all combinations at minimum. If you were cracking a password wouldn't it be significantly faster to use GPU(s) rather than CPUs [1]? If so, why bother mentioning how long it would take on a CPU at all? [1] http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...
- curun1r 10y ago
  > If you were cracking a password wouldn't it be significantly faster to use GPU(s) rather than CPUs? When you're dealing with time scales greater than a decade, probably not. The right answer is almost always to wait until future hardware is available that can crack the password significantly faster than our current CPUs and GPUs. Whether that's quantum computers or just faster iterations of the kind of stuff we've got now doesn't really matter...the time spent waiting for new hardware is insignificant compared to the time spent waiting for calculations on current hardware to complete. But I agree that it's disingenuous to list numbers like that because they're meaningless and aren't at all the answer to the "How soon can my password be cracked?" question.
  - web007 10y ago
    2^70 / 6,000,000 years / 365.25 days / 24 hours / 60 minutes / 60 seconds = 6.2 million reference guesses per second. Modern multi-GPU instances are 560,000x faster, 350 billion guesses per second. So that gets you to 6 million years / 560,000 = ~100 years. So "decade" isn't accurate in this case, but only because of the awful comparison to begin with. Comparing a 2013 CPU to even a 2013 GPU will give you a 100 or 1000x bump easily, and since this is a case of "embarrassingly parallel" operation your scale is much smaller than expected. Also note: 350 billion is for NTLM in 2012. I can't find equivalent stats for modern GPUs from a few minutes of searching on my phone, but I know they're a factor of 2-10x better, so 2^70 is easily within reach.
- 10y ago
ninov 10y ago
I wrote something similar some time ago: https://addons.mozilla.org/de/firefox/addon/masterkey/ https://addons.mozilla.org/de/firefox/addon/masterkey/ https://github.com/ninov/masterkey-firefox https://github.com/ninov/masterkey-firefox Or as android app: https://play.google.com/store/apps/details?id=de.ninov.masterkey&hl=de https://play.google.com/store/apps/details?id=de.ninov.maste... It works by using SHA256-HMAC on the service name with your master key as key and then encoding it in Base85 or Base62 (if you don't want special characters)
boot13 10y ago
This seems similar to Master Password (http://masterpasswordapp.com/ http://masterpasswordapp.com/).
- marvel_boy 10y ago
  And Master Password is free software (GPLv3) (http://masterpasswordapp.com/ http://masterpasswordapp.com/).
nautical 10y ago
This is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free . http://masterpasswordapp.com/ http://masterpasswordapp.com/
- zerognowl 10y ago
  +1 for masterpassword. I always loved the concept of brain vaults. One thing about masterpassword is that I don't trust the clients and I can't inspect what's being logged when I fire up the app. The iOS app is closed source and proprietary and although the idea is great, the clients are not to be trusted. Get yourself a copy of the Javascript client, and place it in a secure VM so you have full oversight of what the code is doing. And don't let the application talk to the internet...
Grangar 10y ago
Does this also support shared folders for teams?
- marcusfrex 10y ago
  We are working on Enterprise version of it which will be having this option.
SloopJon 10y ago
As I see it, the main benefit of deterministic password generation is the convenience of not needing a password database. Indeed, if the scheme is simple and/or portable enough (e.g., PBKDF2) you can implement it from scratch in a minute or two, depending on what software you have handy. The convenience breaks down as you need to maintain additional state: password rotation, site-specific password rules, etc. Forgiva is based on the premise that a password generation scheme is more secure than a password database. I'm unconvinced in general; from what I see in the FAQ and the Ruby code on Github, even less so for this particular implementation. Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell.
- marcusfrex 10y ago
  >> Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell. Sooner or later key-derivation schemes gets outdated and requires a better version as happened to bcrypt [1] and will happen to scrypt [2]. It is not "whatever OpenSSL provides" but just combining strong algorithms over to spread the "getting outdated" risks. Think like you are investing your money? Would you prefer betting on just one thing or spreading it over various different investment opportunities? [1] http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html [2] http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scryp...
  - tptacek 10y ago
    Not only did that not happen to bcrypt, but the whole point of bcrypt is that that doesn't happen: it's an adaptive hashing scheme, which means it comes with a dial you can turn to up the hardness as computers get faster. I would be nervous about taking password storage advice from someone who thinks bcrypt "got outdated and requires a better version". We had a Password Hashing Competition because people realized that password hashing and KDFs had become an important topic that hadn't received significant formal study. Similarly: we're having a CAESAR competition because people have recognized the importance of all-in-one authenticated encryption constructions. The existence of CAESAR, AEZ, NORX, &c doesn't mean that Poly1305-AES is "outdated and requires a better version".
redpanda_ua 10y ago
Why buy that, when there is open-source and free https://ssl.masterpasswordapp.com/ https://ssl.masterpasswordapp.com/
AdmiralAsshat 10y ago
A couple thoughts that came to mind as I was reading it: 1) How is this safer than a standard password manager with TOTP-based 2FA? The second token, either produced by TOTP or something like a Yubikey, would guard against keyloggers, since the one-time code is useless after it has been entered. 2) How is the certificate generated, and what is it based on? Is the cert unique per device, or would I copy it to my other devices that need to access Forgiva ala a public key? 3) There are some typos and other grammatical weirdness on the page that suggests English is not the writer's first language. That's fine, but it looks unprofessional. I can make some proofreading suggestions if you feel inclined. I don't really believe in this product, but I'd prefer it to be judged on its technical integrity rather than the quality of its marketing, so I'd be happy to help polish it up.
- marcusfrex 10y ago
  >> 1) How is this safer than a standard password manager with TOTP-based 2FA? The second token, either produced by TOTP or something like a Yubikey, would guard against keyloggers, since the one-time code is useless after it has been entered. No matter how many factors you are using, sooner-or-later you pass it with keyboards.And that step may be intercepted and you may think that you sent the second token to the other-side but failed. I can provide you a special investigation of Sceptive to show how 2-factor-authentications has been bypassed by malwares targeting Eastern-Europe banks. >> 2) How is the certificate generated, and what is it based on? Is the cert unique per device, or would I copy it to my other devices that need to access Forgiva ala a public key? It is not unique per device. You can copy it to all devices you use no matter what. >> 3) There are some typos and other grammatical weirdness on the page that suggests English is not the writer's first language. That's fine, but it looks unprofessional. I can make some proofreading suggestions if you feel inclined. I don't really believe in this product, but I'd prefer it to be judged on its technical integrity rather than the quality of its marketing, so I'd be happy to help polish it up. It would be an excellent help, we are very unprofessional on language and marketing -as you well see-. Can you please send an e-mail to us at info@forgiva.com to tell us our mistakes?
KirinDave 10y ago
The Windows 64-bit installer is giving a bad signature even though its SHA256 installer hash appears to be correct. It looks like they used SHA1 checks in the installer. I suspect the author doesn't realize that older Win installers that use SHA1 are blindly rejected by Win10 as a security measure (mostly because it's so feasible to game). It is a very poor introduction to the application on the majority platform.
- marcusfrex 10y ago
  Actually installer compiled using Visual Studio 2015 on Windows 10 platform. Nothing specifically edited to the way of SHA1 but we fix it on next release. >> It is a very poor introduction to the application on the majority platform. Yes you are right it can be better and will be.
tptacek 10y ago
I'm reading the open source code and this thing is... odd. For instance: it has a "simple", "intermediate", and "advanced" password complexity, and depending on which you choose, it uses SHA1, SHA2-256, and SHA2-512 for the PBKDF2 hash. What does password complexity have to do with the strength of the algorithm used to generate passwords? Also: it's 2016. Why is this using PBKDF2? If PBKDF2 is what you've got and you're protecting a website, that's fine, but this is a password manager. Is the "commercial" version of this also Ruby code wrapping OpenSSL?
- Cyph0n 10y ago
  It would be better to use more hashing rounds as changing the algorithm itself doesn't require more computational effort from the attacker.
  - nickpsecurity 10y ago
    I argued with that since cryptographers first told me about it. Ludicrous concept. The goal is to eliminate brute force attacks by making the process inherently slow. That technique starts with something inherently ultra-fast that everyone is trying to speed up and hardware accelerate then iterates it a bit. Better concept to get a slow process is design an algorithm that is inherently slow and hard to speed up, esp requiring many memory accesses. My hack, aimed at defeating FPGA's, was putting a random stream into no less than 16MB of RAM (SRAM limit at time) that I iterated through randomly with a hash function. All inherently sequential, random, and large. Accelerate that! Fortunately, Colin Percival came up with a much better solution in scrypt. It's a nice default if you want something battle-tested for a long time. Nobody should be using SHA-1, etc with solutions like scrypt available.
    - tptacek 10y ago
      Just pick a real password hash and dial up the hardness as high as you reasonably can for your environment. Don't do anything more complicated than that.
      - 10y ago
Canada 10y ago
How does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc. How does this handle changing passwords? How can I know from the master secret that xyz.com is on the 4th password?
- marcusfrex 10y ago
  >> How does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc. You can specify password length if it gets too long and it's character set provides symbols, numbers and letters in it. >> How does this handle changing passwords? It has a renewal mechanism to switch to a new password. >> How can I know from the master secret that xyz.com is on the 4th password? Can you explain more about what you mean?
  - Canada 10y ago
    Okay, so the password generation is deterministic, based on a single secret I need to remember right? So then there has to be metadata to list the site domain, username, which generation of password, which characters are allowed or disallowed, length, KDF difficulty, etc? Where is that information stored? What I'm getting at is with a brain wallet I only need to remember my secret and know the algorithm used to generate the key. With this it seems like you need a database to store more information, and without it, it's difficult to get your passwords back.
burgerdev 10y ago
> To crack a password with 70 bit entrophy Consider proof-reading the website: I wouldn't trust someone to do my crypto who can't spell the basics.
- marcusfrex 10y ago
  You are definitely right.
mgleason_3 10y ago
At first I wondered if it was a spoof. However, it could be incorrect grammar: > If you suspect against keyloggers or malware, Forgiva presents a visual confirmation ystem which leaves less hope for the attackers. But maybe it's actually phishing?!?: > And if you get registered, Forgiva uses your registration signature to generate special passwords for you. That means for a successful attack it will require keyboard and monitor access, plus a file system gain too.
zck 10y ago
From the FAQ (https://forgiva.com/faq https://forgiva.com/faq): > How about for sites with restrictive password requirements? > Passwords, generated by Forgiva are offered with 16 characters minimum (you can go up to 32 characters by default) of length and 70 bits of entropy guaranteed on normal complexity level. And it is called on strong level for financial institutions and military grade applications. > Thus it is not expected for any site to deny Forgiva generated passwords. This seems naive, at best. If you can't store an eight character alphanumeric password, you're not usefully managing passwords.
ryan-c 10y ago
I don't have the time to review the design of this right now, but is there anything to stop attempts to crack the master password from a plain, or even hash of a derived password? The encrypted password database is an advantage. You have to steal it to be able to even try cracking. If it's fully deterministic, anyone with any output can go nuts trying to crack the master password, and then get all other credentials.

97 points by marcusfrex 10y ago

Cool idea, but the main gripe I have with it is that the passwords it generates are clearly not made for remembering, but regenerating them takes multiple seconds.

SNvD7vEJ 10y ago

How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage problems with highly secure way. What does that even mean?

marcusfrex 10y ago
>> How does this compare, for example, to the KeePass family of pw-managers? It is a password manager too but with an alternative approach. >> "Fixes poor passwords, accessibility and storage problems with highly secure way." >> What does that even mean? Generates strong passwords by default, you can access them anywhere with it and does not need to store anywhere.
- SNvD7vEJ 10y ago
  Ok, cool that you can access it anywhere.
- ComodoHacker 10y ago
  >you can access them anywhere with it and does not need to store anywhere But you have to carry the database with you anyway and have to store somewhere. So what's the point of having database with everything but passwords? And you still need the database encrypted, because you don't want to give the attacker your usernames, emails, recovery answers and other stuff, do you?
  - SNvD7vEJ 10y ago
    Maybe the point is that you do not need to store the database securely, that you can store it openly, as long as the certificate used to generate the passwords is kept secret. But you probably want to keep the meta info of what sites you have access to secret to. So I don't know why this is better than simply use the certificate to encrypt the database. But maybe I did not understand how it works.
buro9 10y ago
The way I read it... it's a password manager that doesn't store passwords (centrally or locally). Instead it regenerates the password each time. i.e. password for HN may be: some trait of HN (domain?) + some salt + your identity (cert?) to always produce the same password. I didn't understand it all from the site, the explanations and broken English didn't really elucidate. But... if my understanding was right, I wondered about how to handle cert changes or key rolling, etc. There seemed to be a mentioned mechanism for this, but again I didn't really understand that from the description. Gist though: No generated and stored passwords, but a pattern to always generate the same password for a given site.
- SNvD7vEJ 10y ago
  Seems like a really cool idea, as long as the password generator can be proved to be hard enough to break. How long does the retrieval of a password take? Sub-second? 10 seconds?
- cauterized 10y ago
  What happens then if you want/need to rotate your password? How does it deal with stupid password format restrictions?
  - RubyPinch 10y ago
    the salt gets changed so, either password database + master password gets stolen, or salt database + master password gets stolen
    - jjnoakes 10y ago
      Except if the master db is stolen without the master password, one can throw guessed passwords at it and know when one worked (i.e. the db becomes readable). Throwing passwords at a salt db gets you... what?
    - cauterized 10y ago
      But then if the salt is stored and the algorithm is known, doesn't the salt just essentially become the password, from a security standpoint?
dom96 10y ago
It looks like it isn't completely closed source, https://github.com/sceptive/Forgiva https://github.com/sceptive/Forgiva.
- mynameislegion 10y ago
  NC licenses aren't considered "Open Source": http://www.opensource.org/docs/osd http://www.opensource.org/docs/osd
  - dom96 10y ago
    Interesting, but then what do you call something who's source is available to be viewed?
    - dsr_ 10y ago
      "Source-viewable"
    - cyphar 10y ago
      I'd call it proprietary. It's closer to free software, but it's not all the way there.
    - mynameislegion 10y ago
      I call that source code publication or public source code.
  - type0 10y ago
    Then this company - Sceptive is kinda Deceptive. It says on their web page: "Or clone Open Source implementation from Github"

tluyben2 10y ago

I was planning to write one as I do not like existing ones but time is a slight issue: without versions for all platforms and some way to keep them in sync it is hard to switch...

Walkman 10y ago

These security experts forgot one really important thing: usability. I'm not going to wait minutes for one password to generate!

max_ 10y ago

Does this implement Shamir's Secret Sharing?

marcusfrex 10y ago
No. Why should it?
- max_ 10y ago
  added layer of security

dsego 10y ago

I use getvau.lt, how does this compare?

marcusfrex 10y ago
Same strategy but Forgiva doesn't just use one key derivation algorithm (such as PBKDF2) but plus various hashing and encryption algorithms too. And at the same time you may forget the options you used in Vault, it is not an option in Forgiva.
- icebraining 10y ago
  plus various hashing and encryption algorithms too. Is there any evidence that using multiple algorithms has any benefit over simply increasing the cost factor on one?
  - RubyPinch 10y ago
    assuming combined correctly A( B( C(X) ) ), if A becomes broken in the future, its still B( C(X) ), as opposed to just revealing X straight away
    - marcusfrex 10y ago
      Yes, definitely you are right. And at the same time using various other methods "depending on the master key" makes it impossible for an accurate time and process estimation for brute-force attacks.

blowski 10y ago

As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when I need them I'm currently really happy with 1Password on both counts, and I don't really understand why I should move. A competitor would need to establish that they are at least as secure as 1Password, and this landing page doesn't do that at all. For all I know, it's been built by a nefarious hacker or some junior Node.js developer who's just discovered security. Has it been audited? What is the roadmap for the project? These things are much more important than some technical explanation that I didn't really understand.

freakz 10y ago
from the About page: "Well respected, international company based on Istanbul which works only with underground talents.Hacks big corporations for good and creates trusted relationships and work hard to protect them against Sith Lords. Helps companies to strengthen their security layers and provides educational services."
marcusfrex 10y ago
Theoretically stored passwords are not safe at all. Sooner or later they will get stolen if it is the case. Forgiva is actually big brother of kyle (https://github.com/esurharun/kyle https://github.com/esurharun/kyle) which has been at use for nearly 2 years and experienced and tested a lot. Yes, you are definitely right on that we should put roadmap on webpage. And no we are nor "nefarious" hackers neither junior NodeJS developers. :)
- danieldk 10y ago
  Theoretically stored passwords are not safe at all. What does this even mean? Aren't they as safe as the cryptography being used (key derivation scheme, encryption method, etc.)? (Of course, if a machine is compromised with a keylogger, it's pretty much game over anyway. Unless you use a hardware authentication token.)
  - 10y ago

SpendBig 10y ago

Your password will never be secure when you store it on someone else his disk or let someone else encrypt your password. Its not a matter of how, but when there will be a way to retreive those passwords by anything but you. And its not just that, everything you use your passwords for these days, is stored on some sort of storage in a cloudy architecture. Scattered all over the world in thousands of datacenters. You probably are currently trusting thousands of people working over there, but you dont even know these guys. Terrible imho..

SNvD7vEJ 10y ago
What do you mean? This solution does not store passwords at all, if I understand it correctly. So whining about storing them on "someone else disk" is a bit odd, don't you think?
- SpendBig 10y ago
  In the overview, it says on cloud or local. Which made me think, why would you even suggest storing this on a cloudy device when your offering a password manager.
  - icebraining 10y ago
    In the overview, it says on cloud or local. Where? I don't see "cloud" anywhere on that page..?
  - Klathmon 10y ago
    Why would offering cloud storage as an option be a problem if you don't use it? Some people value usability over absolute security.
BrandoElFollito 10y ago
You are right. Only after having reviewed the code for the OS (and before that reverse - engineered the BIOS firmware), recompiled it yourself and then reviewed & recompiled keepass can you state that you are safe. This is the recommended way to go for the standard user to have his passwords safely stored. The alternative to trust a well - established company with your Tinder or gmail password is unthinkable.

amingilani 10y ago

Semi OT, I wrote this satircal piece on how passwords are dead yesterday: https://news.ycombinator.com/item?id=12613433 https://news.ycombinator.com/item?id=12613433

tf2manu994 10y ago

What would happen if the site's domain changes? Or my email changes? Or something else about the metadata changes? Now what if this happens on a site where you can not reset passwords, such as blockchain.info, am I SOL? I like storing passwords becuase I have 100% certainty that it won't just magically generate the wrong one.

huxflux2003 10y ago

No mobile apps?

marcusfrex 10y ago
Upcoming. And planning to make it available as Telegram Bot.

arthurfm 10y ago

> To crack a password with 70 bit entropy on a MacBook Pro Early 2013 it will take ~6 million years to complete all combinations on Normal complexity. On Intermediate complexity it will take ~24 million years and on Advanced complexity it will take ~280 million years to reach all combinations at minimum. If you were cracking a password wouldn't it be significantly faster to use GPU(s) rather than CPUs [1]? If so, why bother mentioning how long it would take on a CPU at all? [1] http://arstechnica.com/security/2012/12/25-gpu-cluster-cracks-every-standard-windows-password-in-6-hours/ http://arstechnica.com/security/2012/12/25-gpu-cluster-crack...

curun1r 10y ago
> If you were cracking a password wouldn't it be significantly faster to use GPU(s) rather than CPUs? When you're dealing with time scales greater than a decade, probably not. The right answer is almost always to wait until future hardware is available that can crack the password significantly faster than our current CPUs and GPUs. Whether that's quantum computers or just faster iterations of the kind of stuff we've got now doesn't really matter...the time spent waiting for new hardware is insignificant compared to the time spent waiting for calculations on current hardware to complete. But I agree that it's disingenuous to list numbers like that because they're meaningless and aren't at all the answer to the "How soon can my password be cracked?" question.
- web007 10y ago
  2^70 / 6,000,000 years / 365.25 days / 24 hours / 60 minutes / 60 seconds = 6.2 million reference guesses per second. Modern multi-GPU instances are 560,000x faster, 350 billion guesses per second. So that gets you to 6 million years / 560,000 = ~100 years. So "decade" isn't accurate in this case, but only because of the awful comparison to begin with. Comparing a 2013 CPU to even a 2013 GPU will give you a 100 or 1000x bump easily, and since this is a case of "embarrassingly parallel" operation your scale is much smaller than expected. Also note: 350 billion is for NTLM in 2012. I can't find equivalent stats for modern GPUs from a few minutes of searching on my phone, but I know they're a factor of 2-10x better, so 2^70 is easily within reach.
10y ago

ninov 10y ago

I wrote something similar some time ago: https://addons.mozilla.org/de/firefox/addon/masterkey/ https://addons.mozilla.org/de/firefox/addon/masterkey/ https://github.com/ninov/masterkey-firefox https://github.com/ninov/masterkey-firefox Or as android app: https://play.google.com/store/apps/details?id=de.ninov.masterkey&hl=de https://play.google.com/store/apps/details?id=de.ninov.maste... It works by using SHA256-HMAC on the service name with your master key as key and then encoding it in Base85 or Base62 (if you don't want special characters)

boot13 10y ago

This seems similar to Master Password (http://masterpasswordapp.com/ http://masterpasswordapp.com/).

marvel_boy 10y ago
And Master Password is free software (GPLv3) (http://masterpasswordapp.com/ http://masterpasswordapp.com/).

nautical 10y ago

This is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free . http://masterpasswordapp.com/ http://masterpasswordapp.com/

zerognowl 10y ago
+1 for masterpassword. I always loved the concept of brain vaults. One thing about masterpassword is that I don't trust the clients and I can't inspect what's being logged when I fire up the app. The iOS app is closed source and proprietary and although the idea is great, the clients are not to be trusted. Get yourself a copy of the Javascript client, and place it in a secure VM so you have full oversight of what the code is doing. And don't let the application talk to the internet...

Grangar 10y ago

Does this also support shared folders for teams?

marcusfrex 10y ago
We are working on Enterprise version of it which will be having this option.

SloopJon 10y ago

As I see it, the main benefit of deterministic password generation is the convenience of not needing a password database. Indeed, if the scheme is simple and/or portable enough (e.g., PBKDF2) you can implement it from scratch in a minute or two, depending on what software you have handy. The convenience breaks down as you need to maintain additional state: password rotation, site-specific password rules, etc. Forgiva is based on the premise that a password generation scheme is more secure than a password database. I'm unconvinced in general; from what I see in the FAQ and the Ruby code on Github, even less so for this particular implementation. Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell.

marcusfrex 10y ago
>> Spamming the input with an array of whatever OpenSSL algorithms Ruby happens to make available, rather than using a memory hard KDF like scrypt, is a bad smell. Sooner or later key-derivation schemes gets outdated and requires a better version as happened to bcrypt [1] and will happen to scrypt [2]. It is not "whatever OpenSSL provides" but just combining strong algorithms over to spread the "getting outdated" risks. Think like you are investing your money? Would you prefer betting on just one thing or spreading it over various different investment opportunities? [1] http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html http://www.unlimitednovelty.com/2012/03/dont-use-bcrypt.html [2] http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scrypt.html http://blog.ircmaxell.com/2014/03/why-i-dont-recommend-scryp...
- tptacek 10y ago
  Not only did that not happen to bcrypt, but the whole point of bcrypt is that that doesn't happen: it's an adaptive hashing scheme, which means it comes with a dial you can turn to up the hardness as computers get faster. I would be nervous about taking password storage advice from someone who thinks bcrypt "got outdated and requires a better version". We had a Password Hashing Competition because people realized that password hashing and KDFs had become an important topic that hadn't received significant formal study. Similarly: we're having a CAESAR competition because people have recognized the importance of all-in-one authenticated encryption constructions. The existence of CAESAR, AEZ, NORX, &c doesn't mean that Poly1305-AES is "outdated and requires a better version".

redpanda_ua 10y ago

Why buy that, when there is open-source and free https://ssl.masterpasswordapp.com/ https://ssl.masterpasswordapp.com/

AdmiralAsshat 10y ago

A couple thoughts that came to mind as I was reading it: 1) How is this safer than a standard password manager with TOTP-based 2FA? The second token, either produced by TOTP or something like a Yubikey, would guard against keyloggers, since the one-time code is useless after it has been entered. 2) How is the certificate generated, and what is it based on? Is the cert unique per device, or would I copy it to my other devices that need to access Forgiva ala a public key? 3) There are some typos and other grammatical weirdness on the page that suggests English is not the writer's first language. That's fine, but it looks unprofessional. I can make some proofreading suggestions if you feel inclined. I don't really believe in this product, but I'd prefer it to be judged on its technical integrity rather than the quality of its marketing, so I'd be happy to help polish it up.

marcusfrex 10y ago
>> 1) How is this safer than a standard password manager with TOTP-based 2FA? The second token, either produced by TOTP or something like a Yubikey, would guard against keyloggers, since the one-time code is useless after it has been entered. No matter how many factors you are using, sooner-or-later you pass it with keyboards.And that step may be intercepted and you may think that you sent the second token to the other-side but failed. I can provide you a special investigation of Sceptive to show how 2-factor-authentications has been bypassed by malwares targeting Eastern-Europe banks. >> 2) How is the certificate generated, and what is it based on? Is the cert unique per device, or would I copy it to my other devices that need to access Forgiva ala a public key? It is not unique per device. You can copy it to all devices you use no matter what. >> 3) There are some typos and other grammatical weirdness on the page that suggests English is not the writer's first language. That's fine, but it looks unprofessional. I can make some proofreading suggestions if you feel inclined. I don't really believe in this product, but I'd prefer it to be judged on its technical integrity rather than the quality of its marketing, so I'd be happy to help polish it up. It would be an excellent help, we are very unprofessional on language and marketing -as you well see-. Can you please send an e-mail to us at info@forgiva.com to tell us our mistakes?

KirinDave 10y ago

The Windows 64-bit installer is giving a bad signature even though its SHA256 installer hash appears to be correct. It looks like they used SHA1 checks in the installer. I suspect the author doesn't realize that older Win installers that use SHA1 are blindly rejected by Win10 as a security measure (mostly because it's so feasible to game). It is a very poor introduction to the application on the majority platform.

marcusfrex 10y ago
Actually installer compiled using Visual Studio 2015 on Windows 10 platform. Nothing specifically edited to the way of SHA1 but we fix it on next release. >> It is a very poor introduction to the application on the majority platform. Yes you are right it can be better and will be.

tptacek 10y ago

I'm reading the open source code and this thing is... odd. For instance: it has a "simple", "intermediate", and "advanced" password complexity, and depending on which you choose, it uses SHA1, SHA2-256, and SHA2-512 for the PBKDF2 hash. What does password complexity have to do with the strength of the algorithm used to generate passwords? Also: it's 2016. Why is this using PBKDF2? If PBKDF2 is what you've got and you're protecting a website, that's fine, but this is a password manager. Is the "commercial" version of this also Ruby code wrapping OpenSSL?

Cyph0n 10y ago
It would be better to use more hashing rounds as changing the algorithm itself doesn't require more computational effort from the attacker.
- nickpsecurity 10y ago
  I argued with that since cryptographers first told me about it. Ludicrous concept. The goal is to eliminate brute force attacks by making the process inherently slow. That technique starts with something inherently ultra-fast that everyone is trying to speed up and hardware accelerate then iterates it a bit. Better concept to get a slow process is design an algorithm that is inherently slow and hard to speed up, esp requiring many memory accesses. My hack, aimed at defeating FPGA's, was putting a random stream into no less than 16MB of RAM (SRAM limit at time) that I iterated through randomly with a hash function. All inherently sequential, random, and large. Accelerate that! Fortunately, Colin Percival came up with a much better solution in scrypt. It's a nice default if you want something battle-tested for a long time. Nobody should be using SHA-1, etc with solutions like scrypt available.
  - tptacek 10y ago
    Just pick a real password hash and dial up the hardness as high as you reasonably can for your environment. Don't do anything more complicated than that.
    - 10y ago

Canada 10y ago

How does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc. How does this handle changing passwords? How can I know from the master secret that xyz.com is on the 4th password?

marcusfrex 10y ago
>> How does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc. You can specify password length if it gets too long and it's character set provides symbols, numbers and letters in it. >> How does this handle changing passwords? It has a renewal mechanism to switch to a new password. >> How can I know from the master secret that xyz.com is on the 4th password? Can you explain more about what you mean?
- Canada 10y ago
  Okay, so the password generation is deterministic, based on a single secret I need to remember right? So then there has to be metadata to list the site domain, username, which generation of password, which characters are allowed or disallowed, length, KDF difficulty, etc? Where is that information stored? What I'm getting at is with a brain wallet I only need to remember my secret and know the algorithm used to generate the key. With this it seems like you need a database to store more information, and without it, it's difficult to get your passwords back.

burgerdev 10y ago

> To crack a password with 70 bit entrophy Consider proof-reading the website: I wouldn't trust someone to do my crypto who can't spell the basics.

marcusfrex 10y ago
You are definitely right.

mgleason_3 10y ago

At first I wondered if it was a spoof. However, it could be incorrect grammar: > If you suspect against keyloggers or malware, Forgiva presents a visual confirmation ystem which leaves less hope for the attackers. But maybe it's actually phishing?!?: > And if you get registered, Forgiva uses your registration signature to generate special passwords for you. That means for a successful attack it will require keyboard and monitor access, plus a file system gain too.

zck 10y ago

From the FAQ (https://forgiva.com/faq https://forgiva.com/faq): > How about for sites with restrictive password requirements? > Passwords, generated by Forgiva are offered with 16 characters minimum (you can go up to 32 characters by default) of length and 70 bits of entropy guaranteed on normal complexity level. And it is called on strong level for financial institutions and military grade applications. > Thus it is not expected for any site to deny Forgiva generated passwords. This seems naive, at best. If you can't store an eight character alphanumeric password, you're not usefully managing passwords.

ryan-c 10y ago

I don't have the time to review the design of this right now, but is there anything to stop attempts to crack the master password from a plain, or even hash of a derived password? The encrypted password database is an advantage. You have to steal it to be able to even try cracking. If it's fully deterministic, anyone with any output can go nuts trying to crack the master password, and then get all other credentials.