4 ms·

I think my dream password manager currently is a Pinephone with a special custom UI that allows for managing and securing a list of accounts/passwords that can

by megous 1y ago

I think my dream password manager currently is a Pinephone with a special custom UI that allows for managing and securing a list of accounts/passwords that can type them out via USB HID keyboard gadget when prompted. No way to prompt it for data, or compromise it remotely. No other features, no OS userspace, no wifi, no adb, no nothing. Just a Linux kernel + a tiny single userspace static binary based on lvgl for UI and libsodium for encryption/storage. Normally powered off, boots in 2 seconds. :)

bee_rider 1y ago
Why a phone, though? The device doesn’t need any connectivity other than to act as a USB “keyboard,” right? Maybe a raspberry pi zero could do it.
- megous 1y ago
  Cheaper, with integrated display, battery, touchscreen, working software, and nice form factor for the use case, sane fully open bootloader and firmware, full documentation for everything, much more power efficient.
lxgr 1y ago
Tons of ways to compromise it between your computer's USB port and the server's database, though. If you already have dedicated hardware, FIDO authenticators make much more sense. > Just a Linux kernel [...] That's several orders of magnitude more lines of code than any FIDO authenticator implementation. > Normally powered off, boots in 2 seconds. :) Yubikeys boot even faster!
- wkat4242 1y ago
  Yeah and also it's huge for just a password manager.
- megous 1y ago
  None of this is a problem. FIDO2 works only with websites that support it.
- odo1242 1y ago
  > Tons of ways to compromise it between your computer's USB port and the server's database, though. If you already have dedicated hardware, FIDO authenticators make much more sense. I mean, if you have the amount of access needed to compromise a USB connection, you have way more than enough access than needed to just yoink the authentication token or encryption key from browser storage.
bkettle 1y ago
I made one of these a while ago in school, it was fun! I think it's a great idea. Mine really had nothing: an overly complicated MCU, since it was provided by the class, but otherwise no need for an OS or anything: https://benkettle.xyz/projects/password-keeper/ https://benkettle.xyz/projects/password-keeper/
- megous 1y ago
  Nice. My wishlist also includes something similar looking with Luckfox Pico Mini + small OLED for displaying info about requests (via USB), to authorize various crypto operations with secret material stored on the device. :)
  - 70rd 1y ago
    Check out Precursor (FPGA device with softcore CPU running on it for trustability). Xous (microkernel OS for Precursor) has an application called Vault that does FIDO2/U2F as well as password management and USB HID emulation. https://www.crowdsupply.com/sutajio-kosagi/precursor/updates/xous-release-v0-9-9-vault-authentication-app-and-more https://www.crowdsupply.com/sutajio-kosagi/precursor/updates... Much more on the dev board side and probably overkill for just this purpose but a really cool device.
    - megous 1y ago
      Yeah, very cool! Interestingly, Pinephone is in the almost good intersection of hackable and portable: :) https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor
Imustaskforhelp 1y ago
I do think though that just using a pinephone as just a password manager might make sense for some people (I think) but at the price of pinephone and the features you can get with it, this is really underselling it (I think) Maybe I don't have enough money to buy a pinephone just for this purpose but even if I would have, I would personally look more into soldering (esp32?) or some single board chip (SOC?) with a touch screen sounds nice too. Now I am not kidding, there was this dumb phone which I was using and its cost was like 12.5$ and it had the features of camera, mic , text , messaging, audio, file manager and so much more... Basically it just didn't had a browser or ability to add apps ofc since it wasn't android. But yeah I do believe that something niche could be developed for people like you at maybe 1/10th the price

by megous 1y ago

bee_rider 1y ago

Why a phone, though? The device doesn’t need any connectivity other than to act as a USB “keyboard,” right? Maybe a raspberry pi zero could do it.

megous 1y ago
Cheaper, with integrated display, battery, touchscreen, working software, and nice form factor for the use case, sane fully open bootloader and firmware, full documentation for everything, much more power efficient.

lxgr 1y ago

Tons of ways to compromise it between your computer's USB port and the server's database, though. If you already have dedicated hardware, FIDO authenticators make much more sense. > Just a Linux kernel [...] That's several orders of magnitude more lines of code than any FIDO authenticator implementation. > Normally powered off, boots in 2 seconds. :) Yubikeys boot even faster!

wkat4242 1y ago
Yeah and also it's huge for just a password manager.
megous 1y ago
None of this is a problem. FIDO2 works only with websites that support it.
odo1242 1y ago
> Tons of ways to compromise it between your computer's USB port and the server's database, though. If you already have dedicated hardware, FIDO authenticators make much more sense. I mean, if you have the amount of access needed to compromise a USB connection, you have way more than enough access than needed to just yoink the authentication token or encryption key from browser storage.

bkettle 1y ago

I made one of these a while ago in school, it was fun! I think it's a great idea. Mine really had nothing: an overly complicated MCU, since it was provided by the class, but otherwise no need for an OS or anything: https://benkettle.xyz/projects/password-keeper/ https://benkettle.xyz/projects/password-keeper/

megous 1y ago
Nice. My wishlist also includes something similar looking with Luckfox Pico Mini + small OLED for displaying info about requests (via USB), to authorize various crypto operations with secret material stored on the device. :)
- 70rd 1y ago
  Check out Precursor (FPGA device with softcore CPU running on it for trustability). Xous (microkernel OS for Precursor) has an application called Vault that does FIDO2/U2F as well as password management and USB HID emulation. https://www.crowdsupply.com/sutajio-kosagi/precursor/updates/xous-release-v0-9-9-vault-authentication-app-and-more https://www.crowdsupply.com/sutajio-kosagi/precursor/updates... Much more on the dev board side and probably overkill for just this purpose but a really cool device.
  - megous 1y ago
    Yeah, very cool! Interestingly, Pinephone is in the almost good intersection of hackable and portable: :) https://www.crowdsupply.com/sutajio-kosagi/precursor https://www.crowdsupply.com/sutajio-kosagi/precursor

Imustaskforhelp 1y ago

I do think though that just using a pinephone as just a password manager might make sense for some people (I think) but at the price of pinephone and the features you can get with it, this is really underselling it (I think) Maybe I don't have enough money to buy a pinephone just for this purpose but even if I would have, I would personally look more into soldering (esp32?) or some single board chip (SOC?) with a touch screen sounds nice too. Now I am not kidding, there was this dumb phone which I was using and its cost was like 12.5$ and it had the features of camera, mic , text , messaging, audio, file manager and so much more... Basically it just didn't had a browser or ability to add apps ofc since it wasn't android. But yeah I do believe that something niche could be developed for people like you at maybe 1/10th the price