4 ms·

Show HN: NoKey, a Distributed Password Manager Without a Master Password

37 points by Zinggi 8y ago

Zinggi 8y ago
Hi all! This is my first time posting something to HN, so please be kind. I wanted to show what I’ve been working on for the last 6 months: NoKey, a password manager without a master password. Instead, you can unlock your passwords by confirming from another device. E.g. if you need a password on your PC, you only have to confirm this on your phone. No need to remember any passwords! The vast majority of the code is written in Elm and it’s fully open source. There is a browser extension for Chrome and Firefox and an Android app. The application is only useful with at least two devices, so to really test it out, you’ll have to install it on two devices. There is no iOS version and the web app doesn’t work on Safari either (it's missing some stuff from the Web Crypto API), sorry! Any feedback or questions are greatly appreciated!
- jazoom 8y ago
  Could someone use Firefox and Chrome extension on the same device as two different devices?
  - Zinggi 8y ago
    Yes, but it's a very bad idea. If you'd do this, you could unlock your passwords with a single device by confirming on Firefox or vice-versa on Chrome. This of course also means that if someone steals this device, they can unlock it too. So don't do it.
    - jazoom 8y ago
      Yeah. That's what I don't want. So how do you prevent someone doing just that? They have Chrome open. They then confirm setup in Firefox using Chrome on the same device.
      - Zinggi 8y ago
        When pairing a new device (or in this case a new browser), that device doesn't automatically get any keys! When adding a new device, to complete the setup you also have to be able to unlock a password group, for which you need another device that already has keys. In short, a new device doesn't have the same power as the others from the start, first new keys have to be generated which can only happen if you are able to unlock your passwords. So just don't setup both the Firefox and Chrome extension and you're golden.
        jazoom 8y ago
        Ah. So you essentially need 2 devices to set up a new device.
        Zinggi 8y ago
        Exactly. Or even 3 if you make use of security level 3. The only exception is at the start when there are no passwords stored yet.
        jazoom 8y ago
        That's pretty interesting. It's a trade-off between remembering a password and making sure you have enough devices. I personally would trust my brain (and a backup piece of paper) more than one of my devices that might die at any moment. I use KeePass, but NoKey seems great.
        Zinggi 8y ago
        But wouldn't you agree that your brain + NoKey instead of a piece of paper as a backup would be more secure? And more convenient, as you don't have to type your passwords anymore. I don't wanna push you, just wanna give you some things to think about. As long as you use strong and unique passwords everywhere you're good. Also, it's not a big problem if one of your devices dies, as long as you paired enough devices you won't lose any passwords.
- qz3 8y ago
  I love the Idea, and I think it's pretty smart. When I'm doing work on my laptop, I always have my phone nearby. I think it's unlikely that both of them are compromised or stolen simultaneously. Also, the Android app requires no device permissions, haven't seen that in a while.
  - Zinggi 8y ago
    > the Android app requires no device permissions That's not true, it just uses the new way to ask for permissions. E.g. when you want to scan a QR code it requires the camera permission. But it only asks at that moment, not upfront as older android apps used to do
sushant20 8y ago
Seems like a good idea. What happens when I lose both my devices?
- Zinggi 8y ago
  You lose access to your passwords, that's the consequence of that approach. That's why it's a very good idea to pair as many devices as you can, e.g. an old phone, your work PC, etc. This way you're pretty save from any loss. In general, if you save your passwords with security level N (meaning you need N devices to unlock), if you lose all but N-1 devices, you lose access. You can also add a "key box", which gives you one more "device", but requires you to remember a password.
  - craftyguy 8y ago
    > That's why it's a very good idea to pair as many devices as you can Doesn't this increase your attack surface greatly though? The more devices you have this on, the greater chances that one or more of them could be compromised and used to access your passwords. Since there's no master key, one has to only compromise the OS to get at everything. Given that so many devices do not receive regular security updates, this seems like it would be a concern..
    - Zinggi 8y ago
      > Doesn't this increase your attack surface greatly though? That's true. I suppose it's a trade off between protection against lost vs. smaller attack surface. > Since there's no master key, one has to only compromise the OS to get at everything That's wrong, compromising one device doesn't give an attacker anything useful. Only if two or more devices have been compromised can passwords be decrypted. But in any case, I think if your device is compromised you might be in bigger troubles anyway. E.g. if an attacker controls your device, ransomeware might be easier and more lucrative to them than going after more devices to hunt for passwords.
      - craftyguy 8y ago
darkstar999 8y ago
I like the Correct Horse Battery Staple approach to the pairing mechanism ;-)
- Zinggi 8y ago
  Thanks. I was always wondering why others don't do this more often. I find it much easier to remember and type in a few words compared to a long number.
e_carra 8y ago
This is a great idea and a great example of distributed "consumer" app.
4684499 8y ago
Even though it's different, but in terms of usage, I think it's like a decentralized 2FA (or MFA) solution?
- Zinggi 8y ago
  Yep, from a user perspective it definitely looks like 2FA. In terms of technology it's of course completely different.

37 points by Zinggi 8y ago

Hi all! This is my first time posting something to HN, so please be kind. I wanted to show what I’ve been working on for the last 6 months: NoKey, a password manager without a master password. Instead, you can unlock your passwords by confirming from another device. E.g. if you need a password on your PC, you only have to confirm this on your phone. No need to remember any passwords! The vast majority of the code is written in Elm and it’s fully open source. There is a browser extension for Chrome and Firefox and an Android app. The application is only useful with at least two devices, so to really test it out, you’ll have to install it on two devices. There is no iOS version and the web app doesn’t work on Safari either (it's missing some stuff from the Web Crypto API), sorry! Any feedback or questions are greatly appreciated!

jazoom 8y ago
Could someone use Firefox and Chrome extension on the same device as two different devices?
- Zinggi 8y ago
  Yes, but it's a very bad idea. If you'd do this, you could unlock your passwords with a single device by confirming on Firefox or vice-versa on Chrome. This of course also means that if someone steals this device, they can unlock it too. So don't do it.
  - jazoom 8y ago
    Yeah. That's what I don't want. So how do you prevent someone doing just that? They have Chrome open. They then confirm setup in Firefox using Chrome on the same device.
    - Zinggi 8y ago
      When pairing a new device (or in this case a new browser), that device doesn't automatically get any keys! When adding a new device, to complete the setup you also have to be able to unlock a password group, for which you need another device that already has keys. In short, a new device doesn't have the same power as the others from the start, first new keys have to be generated which can only happen if you are able to unlock your passwords. So just don't setup both the Firefox and Chrome extension and you're golden.
      - jazoom 8y ago
        Ah. So you essentially need 2 devices to set up a new device.
        Zinggi 8y ago
        Exactly. Or even 3 if you make use of security level 3. The only exception is at the start when there are no passwords stored yet.
        jazoom 8y ago
        That's pretty interesting. It's a trade-off between remembering a password and making sure you have enough devices. I personally would trust my brain (and a backup piece of paper) more than one of my devices that might die at any moment. I use KeePass, but NoKey seems great.
        Zinggi 8y ago
        But wouldn't you agree that your brain + NoKey instead of a piece of paper as a backup would be more secure? And more convenient, as you don't have to type your passwords anymore. I don't wanna push you, just wanna give you some things to think about. As long as you use strong and unique passwords everywhere you're good. Also, it's not a big problem if one of your devices dies, as long as you paired enough devices you won't lose any passwords.
qz3 8y ago
I love the Idea, and I think it's pretty smart. When I'm doing work on my laptop, I always have my phone nearby. I think it's unlikely that both of them are compromised or stolen simultaneously. Also, the Android app requires no device permissions, haven't seen that in a while.
- Zinggi 8y ago
  > the Android app requires no device permissions That's not true, it just uses the new way to ask for permissions. E.g. when you want to scan a QR code it requires the camera permission. But it only asks at that moment, not upfront as older android apps used to do

sushant20 8y ago

Seems like a good idea. What happens when I lose both my devices?

Zinggi 8y ago
You lose access to your passwords, that's the consequence of that approach. That's why it's a very good idea to pair as many devices as you can, e.g. an old phone, your work PC, etc. This way you're pretty save from any loss. In general, if you save your passwords with security level N (meaning you need N devices to unlock), if you lose all but N-1 devices, you lose access. You can also add a "key box", which gives you one more "device", but requires you to remember a password.
- craftyguy 8y ago
  > That's why it's a very good idea to pair as many devices as you can Doesn't this increase your attack surface greatly though? The more devices you have this on, the greater chances that one or more of them could be compromised and used to access your passwords. Since there's no master key, one has to only compromise the OS to get at everything. Given that so many devices do not receive regular security updates, this seems like it would be a concern..
  - Zinggi 8y ago
    > Doesn't this increase your attack surface greatly though? That's true. I suppose it's a trade off between protection against lost vs. smaller attack surface. > Since there's no master key, one has to only compromise the OS to get at everything That's wrong, compromising one device doesn't give an attacker anything useful. Only if two or more devices have been compromised can passwords be decrypted. But in any case, I think if your device is compromised you might be in bigger troubles anyway. E.g. if an attacker controls your device, ransomeware might be easier and more lucrative to them than going after more devices to hunt for passwords.
    - craftyguy 8y ago

darkstar999 8y ago

I like the Correct Horse Battery Staple approach to the pairing mechanism ;-)

Zinggi 8y ago
Thanks. I was always wondering why others don't do this more often. I find it much easier to remember and type in a few words compared to a long number.

e_carra 8y ago

This is a great idea and a great example of distributed "consumer" app.

4684499 8y ago

Even though it's different, but in terms of usage, I think it's like a decentralized 2FA (or MFA) solution?

Zinggi 8y ago
Yep, from a user perspective it definitely looks like 2FA. In terms of technology it's of course completely different.