5 ms·

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make

Product idea! A little e-ink display (let's call it a Password Storage Device or PSD) with a tiny processor and enough memory to store all your passwords. Make them cheap enough that you can have a few redundant copies in various places. - OS sees the device as a keyboard - Two versions. One with bluetooth, and one with only USB for a little more security. - Open source software package to sync your collection of PSDs - Open source browser extension to autofill passwords - Tiny keyboard on the device (detachable to share between your collection?) Usage: 1. Install browser extension 2. Navigate to a password field 3. Follow prompt to populate password Alternate usage: 1. Manually search for password using the device keyboard 2. Click into password field in browser 3. Press button on device to have it type the password Or of course you could just view the password on the device if you prefer.

VoidWhisperer 4y ago
You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.
- Steltek 4y ago
  The phone would still see the device as a Bluetooth or USB keyboard and the "alternate usage" should work.
- vel0city 4y ago
  Android and iOS work with Bluetooth keyboards.
  - dotancohen 4y ago
    But not _as_ bluetooth keyboards, which is what the proposed feature requires.
tcoff91 4y ago
You can use the Trezor as a password manager. Passwords are not stored on the device, but the key and all encryption/decryption happens on the device.
NationOfJoe 4y ago
such as this open source device? https://hackaday.com/tag/mooltipass/ https://hackaday.com/tag/mooltipass/
- MetaWhirledPeas 4y ago
  Yeah that's pretty close to it. It has some unexpected features though, like automatic logout. Weird!
imiric 4y ago
No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms. Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centralized honeypot, in the case of services like LastPass). The industry has been trending towards OTP, FIDO, WebAuthn, and all sorts of identity solutions, instead for years now. It's clear that nobody wants to manage credentials, and having a separate security device is not something mainstream audiences will adopt, so maybe by integrating it with smartphones, this will finally catch on. It will likely take years for most of the industry to move away from passwords, and we'll likely still require traditional credentials in some cases. The myriad of standards out there is a hurdle for adoption, but it feels like we're settling on something that might be usable for everyone.
- danenania 4y ago
  Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.
  - mccorrinall 4y ago
    When I was studying we had to use the computers in uni when presenting homework. It gets really annoying when you want to sign into $service on those machines, but you need to use a magic link. Because the you need to login into your gmail, which requires an additional 2fa (and you can’t receive sms in a building that has 6 stories but no femto cells). Unfortunately google requires either their app or SMS. They dropped pure totp for some reason. Awful experience.
    - tpxl 4y ago
      > Unfortunately google requires either their app or SMS. They dropped pure totp for some reason. Gmail TOTP still works fine?
Too 4y ago
Isn’t this a yubikey? Except a yubikey can also do a lot more, primarily sign tokens without private key ever leaving the device. Which, as someone else explained below, is far superior to plain text passwords.
- MetaWhirledPeas 4y ago
  Yubikey is really great, but it's for 2FA, not password storage. My thought was to replace cloud password managers.
  - jve 4y ago
    You can set static password for yubikey double click. But then it is only a single factor - something you own and just doubleclick to input that key. https://www.yubico.com/resources/glossary/static-password/ https://www.yubico.com/resources/glossary/static-password/
pakl 4y ago
The Precursor should tick your boxes, and with an FPGA-based SOC. https://www.crowdsupply.com/sutajio-kosagi/precursor/updates/xous-release-v0-9-9-vault-authentication-app-and-more https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...
- _joel 4y ago
  By bunnie too, so you know it'll be good :)
- greyhair 4y ago
  I love the price on that.
bee_rider 4y ago
You could have it MITM between your keyboard and computer. Depending on the mode it records your key presses to an entry, or replays an entry. Otherwise it just passes through. Probably just needs a screen and like 3 buttons: record/play/navigate mode (use your keyboard to actually navigate).
- eru 4y ago
  That model (with record) would need me to come up with passwords and type them. Seems like a hassle and a security problem.
  - bee_rider 4y ago
    Needs an “insert random text and record” button too I guess.
whoami_nr 4y ago
I won't lie but I lost you in the steps mentioned here. Finally, IMO, people just want auto-fill/auto-logged in instances without having to enter OTP/type password/do 2FA etc. No matter how you slice it, that's the way people want. Now, how do I compress all these requirements within the boundaries of what is acceptable as a provable source of identity, it becomes a harder problem than you describe. PS: I have worked in computer security and I am drunk. Eat your salt

VoidWhisperer 4y ago

You would also likely need a way to get this to work on a mobile phone too. I know from personal experience that there is plenty of times nowadays that I end up logging in to various places using my password manager (not lastpass) on mobile.

Steltek 4y ago
The phone would still see the device as a Bluetooth or USB keyboard and the "alternate usage" should work.
vel0city 4y ago
Android and iOS work with Bluetooth keyboards.
- dotancohen 4y ago
  But not _as_ bluetooth keyboards, which is what the proposed feature requires.

tcoff91 4y ago

You can use the Trezor as a password manager. Passwords are not stored on the device, but the key and all encryption/decryption happens on the device.

NationOfJoe 4y ago

such as this open source device? https://hackaday.com/tag/mooltipass/ https://hackaday.com/tag/mooltipass/

MetaWhirledPeas 4y ago
Yeah that's pretty close to it. It has some unexpected features though, like automatic logout. Weird!

imiric 4y ago

No offense, but this is such a hacker solution. :) And as mentioned, already exists in many forms. Passwords and login credentials are dead. No user wants to deal with them. Password managers are a solution to somewhat sanely and securely manage this complexity, and not something that the average user wants to think about. In that sense, they don't improve security overall, and introduce many other issues (a centralized honeypot, in the case of services like LastPass). The industry has been trending towards OTP, FIDO, WebAuthn, and all sorts of identity solutions, instead for years now. It's clear that nobody wants to manage credentials, and having a separate security device is not something mainstream audiences will adopt, so maybe by integrating it with smartphones, this will finally catch on. It will likely take years for most of the industry to move away from passwords, and we'll likely still require traditional credentials in some cases. The myriad of standards out there is a hurdle for adoption, but it feels like we're settling on something that might be usable for everyone.

danenania 4y ago
Considering that 99% of web app password authentication reduces to email authentication via ‘forgot password’, a good first step would be dropping the password and just using emailed tokens (or links) directly.
- mccorrinall 4y ago
  When I was studying we had to use the computers in uni when presenting homework. It gets really annoying when you want to sign into $service on those machines, but you need to use a magic link. Because the you need to login into your gmail, which requires an additional 2fa (and you can’t receive sms in a building that has 6 stories but no femto cells). Unfortunately google requires either their app or SMS. They dropped pure totp for some reason. Awful experience.
  - tpxl 4y ago
    > Unfortunately google requires either their app or SMS. They dropped pure totp for some reason. Gmail TOTP still works fine?

Too 4y ago

Isn’t this a yubikey? Except a yubikey can also do a lot more, primarily sign tokens without private key ever leaving the device. Which, as someone else explained below, is far superior to plain text passwords.

MetaWhirledPeas 4y ago
Yubikey is really great, but it's for 2FA, not password storage. My thought was to replace cloud password managers.
- jve 4y ago
  You can set static password for yubikey double click. But then it is only a single factor - something you own and just doubleclick to input that key. https://www.yubico.com/resources/glossary/static-password/ https://www.yubico.com/resources/glossary/static-password/

pakl 4y ago

The Precursor should tick your boxes, and with an FPGA-based SOC. https://www.crowdsupply.com/sutajio-kosagi/precursor/updates/xous-release-v0-9-9-vault-authentication-app-and-more https://www.crowdsupply.com/sutajio-kosagi/precursor/updates...

_joel 4y ago
By bunnie too, so you know it'll be good :)
greyhair 4y ago
I love the price on that.

bee_rider 4y ago

You could have it MITM between your keyboard and computer. Depending on the mode it records your key presses to an entry, or replays an entry. Otherwise it just passes through. Probably just needs a screen and like 3 buttons: record/play/navigate mode (use your keyboard to actually navigate).

eru 4y ago
That model (with record) would need me to come up with passwords and type them. Seems like a hassle and a security problem.
- bee_rider 4y ago
  Needs an “insert random text and record” button too I guess.

whoami_nr 4y ago

I won't lie but I lost you in the steps mentioned here. Finally, IMO, people just want auto-fill/auto-logged in instances without having to enter OTP/type password/do 2FA etc. No matter how you slice it, that's the way people want. Now, how do I compress all these requirements within the boundaries of what is acceptable as a provable source of identity, it becomes a harder problem than you describe. PS: I have worked in computer security and I am drunk. Eat your salt