Where do you keep the keys from your house? Or from you car? In you pocket (at least, us, men). You don't hide it in a secret place by the door, you don't handle them to a special keys-man, you don't send them by mail to the nearest self-storage facility. Just in you pocket. If you manage to loose them, blame yourself only, and just take a second pair of keys from your desk drawer.
Why shouldn't we do the same with our passwords?
We have to keep tens (or even a hundred or more) of them, and cyber crimes are growing more and more sophisticated, stealing passwords from cloud storage, from your cellphone, from your PC. So just don't put your keys under the doormat. Keep you passwords in a small standalone hardware gadget, with small screen and a single button/knob. When you need to enter your login and password - plug the gadget to USB port (No WI-FI, BLE or Bluetooth!), screen comes to life and shows you your available list of accounts, select account name from scrolling list, click a button - voila, username or password is pasted into input field on your PC (or a smartphone!) , no need to enter manually that 'strong password" chaotic line of characters.
As of now a market for hardware password vaults is next to nothing. There are 2 devices with keyboard and a tiny display, plus few 'encrypted' flash drive-like dongles. Those with keyboard and display are unable to transfer password to PC, need batteries and are crazy overpriced.
All of them are focused on encrypting stored passwords, and all of them have just a single master password that gives access to everything stored. What sense does it make to store all of your passwords under a single password??
I believe security of your passwords can be preserved not by storing all of them encrypted under some single key. Passwords just should be stored away from networks, from you PC, from your browser and God forbid away from all sorts of 'clouds'. Store them in a tiny separate device that is never connected to any network. When you need to enter a password - plug the gadget into USB port, and it is recognized as a keyboard. Select username and password from the list on gadget's screen, push a button - your selection is pasted into input field on your PC. Since the device never accesses any network - there is no need to encrypt stored password. Such device works as read-only, no need for editing stored info. Everything is stored on SD card, the card has a single unencrypted .csv file, set of text lines - account, username, password.
If you need to edit it - put SD into you computer and use any text editor. Then take it off your PC, plug into your storage gadget. When connected to USB port, it energizes, reads your file from SD, and displays the content on bright and well readable screen. No battery required.
The only way you passwords can be used without your consent - well, if you loose the device. Or if SD card gets corrupted (broken). Exactly the same way as the keys from your house/car, just don't loose them. And store a duplicate of SD (you key) at home in your desk drawer. (well, good idea might be to add a fingerprint sensor to the gadget as an extra barrier if device is lost/stolen).
So that is the idea.
In brief:
Arduino-like MCU (Teensy in my project) + 320x240 TFT screen + micro-SD board + rotary encoder.
Controls:
rotary encoder with click, used to navigate screen menu ans select menu items.
Push-button below rotary knob, used to initiate soft reset of MCU. Not as if we need it, but it comes with display board, so I tried to make it useful.
Passwords stored on SD as simple .csv file, device does not need battery, it energizes when plugged into USB port and works as a keyboard. When plugged, it shows a list of all accounts on display, list is scrollable with rotary encoder, push encoder knob to select an account, list of two lines is displayed - username and password. Select whatever you need with encoder, push again - string is pasted into...
Read more »
Konstantin D.
J. Peterson
ElectroBoy
mircemk