Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: provide premium sync #36

Open
4 tasks
D-Nice opened this issue Jan 25, 2021 · 0 comments
Open
4 tasks

feat: provide premium sync #36

D-Nice opened this issue Jan 25, 2021 · 0 comments
Assignees
Labels
blocked Something is blocking this from being completed

Comments

@D-Nice
Copy link
Member

D-Nice commented Jan 25, 2021

provide a frictionless sync capability for premium users (tbd by the backup phrase). Some initial ideas are:

  • requires statefulness of generated passwords, however, the password itself would never be stored, but their supporting parameters... prolly complete params to avoid backwards compat issues, could also set some global/re-use key to save space, e.g. defaultParams key, and then use those if certain params missing, or even globalX, and apply those to any in hte object, until another glob definition.

  • the contents at rest should be AES-GCM encrypted, using at the very least, the backup phrase seed, or even another derived key from it, maybe using balloon hashing, in which case we may use the unlock pass seed as well. This should make any cracking, while stored on our servers practically impossible with even the default 12 word backup phrase and a crappy password, let alone with a good password, or moreso 24 words. The latter could safely be stored in public access even... assuming proper encryption, in which case we'll need to take great care of the encryption mechanics. Could use the deterministic IV mechanism based on content to be encrypted.

  • Once a premium user logs in with a matching backup phrase + pw we sync those passwords for them, either opt-in or automatically based on some future options

  • TBD atm we're going with a single pw/backup phrase combo design... if a pw is compromised, you should create a completely new backup phrase/pw combo, and not re-use the old one, so we don't support changing passwords, as that isn't sufficient from a security perspective upon a compromise.

@D-Nice D-Nice added the blocked Something is blocking this from being completed label Jan 25, 2021
@D-Nice D-Nice self-assigned this Jan 25, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
blocked Something is blocking this from being completed
Projects
None yet
Development

No branches or pull requests

1 participant