kestas.kuliukas.com

MultiPass - Easy, safe, simple password manager

MultiPass is a simple, secure, portable app which combines a secret master-password with the name of any number of websites you need passwords for, to create unique, secure passwords for each website. All you need to remember is your master-password and the name of the website and you can re-generate all your secure passwords.

Why? - How? - Usage - Features - Changelog

Get MultiPass: Windows - Linux - JavaScript

Why use it? - The problems MultiPass solves

If you visit lots of websites you'll need lots of user accounts, which means lots of passwords. The problem is we don't have perfect memory, so we end up compromising in some way:

• Using an easy to remember and easy to guess password
• Using the same password in lots of places, which means an attacker with access to one of your sites can access all your other sites
• Post-it notes/password libraries, which means an attacker only needs to find/access this list to get access to everything, or it may get lost resulting in you being locked out of all your accounts

An ideal solution would need a few features:

• The passwords are impossible to guess and secure
• The passwords are not stored anywhere, but can be regenerated whenever/wherever needed
• The access to your passwords is protected with a master-password, which itself should not be stored anywhere
• It shouldn't require new technology like smart-cards or biometric readers; it has to fit into all user/password systems

How MultiPass works

The user provides the master password and the name of the site/application which the password is meant for. The two parameters are hashed into a sequence of bits, which is reduced into a password.
This generated password cannot be used to find the master-password or any other generated passwords.

Put more simply: Master-password + URL -> Scramble -> New password for URL

Nothing needs to be stored, nothing can be lost: As long as you remember the master password you'll be able to regenerate all your passwords at any time, yet each password generated will be unique and secure.

The code used to do this is simple and portable enough to be implemented in the browser using JavaScript (see below), so it can be implemented however/wherever required.

Using MultiPass

- Open

- Enter password

Choose a master-password: This must remain secret and not be used elsewhere, and like all passwords it should be long and secure.
The scrambled master-password on the right is the confirm-code, used later to check that the correct password has been entered.

- Confirm

Now the master-password is confirmed by entering it again, to make sure there were no typos. The two confirm-codes match, so URL/name is enabled.

- Enter URL/Name

Anything you need a password for can now be generated here: Just type the URL/name in and the master-password and URL/name will be combined and scrambled to generate a secure password.

- Generate many secure passwords

By clicking Save to save URLs/names you don't have to enter the full name in every time you need the password. All the URLs/names you save are saved to the drop-down list.

- Open again to retrieve passwords

When you open it up the next time the confirm-code is still on the right.

- Enter password

As you enter in the master-password you chose last time the new confirm-code is checked against the saved one.
(If the master-password is forgotten the confirm-code won't be any help in getting it back.)

- Generate/re-generate passwords

Once the new confirm-code matches the saved one you must have entered the correct master-password, so your password is instantly confirmed without typing it again.

URLs/names and confirm-codes are stored only to make things faster; all you need to know to generate your passwords is the master-password and the URLs/names.

You can try this out for yourself: Use a master-password of "atestpassword", and a URL/name of "http://kestas.kuliukas.com/MultiPass/", and you'll get a generated password "FXdxJw4Jz2"

Other features

• Multi-pass will clear the master-password if it is left unattended for 2 minutes, so no-one can generate your passwords if you leave your desk and forget to lock.
• Once your master-password is confirmed the URL/name will be set to the last saved URL/name that was used.
• The generated password is copied to your clipboard, so once the password you want is generated it can be pasted wherever it's needed.
• No installation is required, it's just a single file.
• It's open-source, you can check to see exactly what it's doing and change it as you like.

Changelog

• 1.1: Generated password copied to clipboard
• 1.2: URL/Name can be saved into a list, password confirmed from saved code
• 1.3: URL/Name list can be backed up to text file
• 1.4: Window will stay on top of other windows while open
• 1.5: Reduced size of confirm-code from 10 to 4 chars to be no larger than required typo-detection size.
  i.e. A 10-char confirm-code "fkjZfdAQ1D" previously matched ~4000 12-letter master-passwords, but "AQ1D" matches ~280,000,000,000,000; useless to narrow down master-password possibilities, while keeping the chance of a typo being confirmed over 10 years of intensive use, with terrible typing, to a fraction of 1%.
• 1.5: Added minimum master-password size restriction, with 8 characters as the default.
• 2.0: Rewrite to use WPF instead of Windows forms (for learning). Backups now done to XML, backups can now be restored by dragging xml/txt file onto MultiPass window, ClickOnce now used so MultiPass will inform you of updates.

Get MultiPass ..

.. for Windows

Install MultiPass. Download MultiPass standalone exe. Download MultiPass source code.

.. for Linux

MultiPass on Ubuntu Linux 10.04 via Mono.

Having to briefly go back to Linux recently I expected I'd need to rewrite this in Java to get access to all of my passwords, but I was stunned at how effectively MonoDevelop imported the Visual Studio solution, compiled it into a .exe that runs on Windows and Linux (via mono) without any changes to the source required.
After this I found that even that wasn't necessary, and that mono can run the Windows compiled exe file below, which is pretty impressive.

So; download MultiPass.zip, extract MultiPass.exe, ensure Mono is installed, and run it using:
$ mono MultiPass.exe

.. in JavaScript

This JavaScript web-browser MultiPass implementation gives a good demo of what MultiPass is, and shows the simplicity and portability of the algorithm. For security and convenience reasons it isn't intended as an alternative to the actual app, just as a demo.

It could be used as a last-resort if you are unable to run programs on a computer but need to know passwords (the reason it was made), but only if you have downloaded and checked a copy of the .js files from a trusted connection.

Do not enter a master-password which you use for serious passwords into any remote web-page, ever!

*Thanks to Paul Johnston for this JavaScript MD5 library.

The passwords generated are the same as the app itself, given the same inputs; try "atestpassword" and "slashdot.org" as in the screenshot above.