Discussion:
Anelok competitor (Pastilda) crowdfunding campaign
Paul Boddie
2017-02-18 22:54:04 UTC
Permalink
Hello,

I saw Pastilda featured a while back on Crowd Supply, and it looks like the
campaign has now started:

https://www.crowdsupply.com/third-pin/pastilda

It's described as an "open-source hardware password manager", although I don't
know how "open source" it actually is. The device sits between your keyboard
and the computer, and the interface appears to involve emulating a keyboard,
with a key combination on your actual keyboard switching to password mode, and
then the device somehow showing credential entries on screen. You seem to need
to use a text field (or similar writable interface) to interact with the
device.

I guess what happens is that the text box you use is where you want a login
name to appear, the device "types" the name of an account or service from its
list into the text box, and it "backspaces" the name and "types" out the next
one when you navigate between accounts. It wouldn't be much of an interface if
you only had a password field and were prompted to choose between "********"
and "********" for your login, but there probably aren't many interfaces like
that. ;-)

I imagine that upon selecting an account, it finally "types" out the username
(or equivalent) in the selected field, then "tabs" to subsequent fields,
hopefully populating them all correctly (and not writing the password into the
wrong one), before issuing "Enter" or "Return". Maybe command line interfaces
allow configuration of whether "tabbing" or "entering" is used, which is
something some annoying Web interfaces would be sensitive to as well.

It seems like a clever approach to avoid weird plugins and extensions on the
computer, if I understand what they're doing. As for the management of
credentials, I haven't looked into that at all. Anyway, I hope it is of mild
interest to the Anelok community.

Paul

_______________________________________________
Qi Hardware Discussion List
Mail to list (members only): ***@lists.en.qi-hardware.com
Subscribe or Unsubscribe: http://lists.en.qi-hardware.com/mailm
Werner Almesberger
2017-02-18 23:52:23 UTC
Permalink
Post by Paul Boddie
I saw Pastilda featured a while back on Crowd Supply, and it looks like the
https://www.crowdsupply.com/third-pin/pastilda
Good ! The more such critters hit the market, the easier it will
be to demonstrate the viability of this class of products.

Let's see how it does compared to Anelok:

Pastilda Anelok
--------------- ----------
Integration-less use (with PC) Yes Yes
Wireless No Yes (1)
Works offline No Yes
Works disconnected (e.g., ATM) No Yes
Secure storage Yes No (2)
Keyboard pass-through USB-USB USB-BT (1)
Price USD 50 USD ~100

(1) Planned, but not implemented in any prototype yet.
(2) Could do it, but it'll be slow, due to having only Full-Speed USB.
But I'd want that in a future version.

There's a bunch of such devices that all need USB. Seems that weaning
them off it is hard. Good :)
Post by Paul Boddie
You seem to need
to use a text field (or similar writable interface) to interact with the
device.
That seems a little worrisome. If they actually echo secrets (such
as the device's master password) through a text field, they could
easily leak, considering all the server-based auto-completion and
partial search functions that many input fields have nowadays.


By the way, Anelok doesn't have to be a spectator sport. A lot of
things that happen in software can be tested with the simulator.

I've written a number of task cards:
https://gitlab.com/anelok/doc/wikis/Tasks

Especially https://gitlab.com/anelok/doc/wikis/Task_altchill
and most of the 2FA group could be implemented with only the
simulator.

But there are many more things that still need doing, e.g.,
- use uSD instead of internal Flash for the password database,
- the database it currently read-only. After it's been moved to
uSD, implement
- new entry creation,
- change of entries,
- renaming/moving of entries,
- deletion

Or maybe something more researchy ?
- to what extend could Anelok interoperate with GPG and similar
systems ? Anelok could simply store the user's secret key, but
maybe we can do better.
- e.g., for signing, the host could compute the hash and Anelok
could sign that hash, with the GPG secret never leaving Anelok.
Would the algorithms currently in use for that allow such a
split ? And would the operations needed on the Anelok side be
compact enough for the MCU ?
- likewise, for encrypting, decrypting.

- Werner

_______________________________________________
Qi Hardware Discussion List
Mail to list (members only): ***@lists.en.qi-hardware.com
Subscribe or Unsubscribe: http://lists.en.qi-
Alexander Stephen Thomas Ross
2017-02-19 00:58:30 UTC
Permalink
Post by Werner Almesberger
But there are many more things that still need doing, e.g.,
- use uSD instead of internal Flash for the password database,
- the database it currently read-only. After it's been moved to
uSD, implement
- new entry creation,
- change of entries,
- renaming/moving of entries,
- deletion
Or maybe something more researchy ?
- to what extend could Anelok interoperate with GPG and similar
err kind sounds like you could use password store to do that? to mange
entries and gpg.
idk... im a newbie....

https://www.passwordstore.org/

_______________________________________________
Qi Hardware Discussion List
Mail to list (members only): ***@lists.en.qi-hardware.com
Subscribe or Unsubscribe: http://lists.en.qi-ha
Werner Almesberger
2017-02-19 02:36:26 UTC
Permalink
Post by Alexander Stephen Thomas Ross
err kind sounds like you could use password store to do that? to mange
entries and gpg.
Ah, didn't know that one. Neat.

I'd be a bit worried about the performance impact of using the
file system, though. Anelok doesn't have a lot of RAM for caching,
so accessing a database would result in a great number of reads.

With a "compact" file that has one entry after another, there'd
be typically less than one (sector) read per entry.

Having said that, I haven't defined any data structure for storage
on the memory card yet, just for MCU Flash. So the's room for
creative experiments.


By the way, there is also a GUI for managing the password database.
That critter, which is still very incomplete and quite atrocious,
lives in https://gitlab.com/anelok/anelok.git
directory gui/

To run it, "make try"

- Werner

Loading...