Giter VIP home page Giter VIP logo

passha's Introduction

pasSHA

Overview.

The purpose of this Project is to create perfectly safe Password Manager and Generator - pasSHA. pasSHA allows User, while remembering only one Password, maintain different Passwords for all the WEB and beyond. The main idea is that pasSHA will NOT keep passwords in any form, but generate them on-the-fly. Existing alternative tools keep generated Passwords in encrypted files. pasSHA is not keeping Passwords in any way (encrypted or not) and that gives assurance, if a file compromised and decrypted NO information will be disclosed.

How pasSHA avoids keeping the Password directly?

Step 1: Tool uses SHA-512 to get Hash Value from User Password (aka Primary).

Step 2: Tool generates random number A from 10 to 255.

Step 3: Hash Value put through SHA-512 for A times. Salt added to avoid overlapping.

Step 4: Final Hash Value used to generate all Passwords (aka Secondary).

Finally: Only value A kept in User file, to reproduce a key.

How secure is it?

This video shows how secure SHA-256 is. pasSHA uses next version, so more security.

Are there additional secure measures?

Yes! User data encrypted using RSA-4096 (in version 3.0).

What rules can be applied to Generated Passwords?

By default, Password will contain numbers and lower case characters. Additionally, user can switch on $peci@l Characters and UPPER CASE Characters.

How strong are Generated Passwords ?

Generated Passwords are non-trivial. Most of the WEB sites, applications etc. recognizes passwords as strong.

What languages does Tool supports ?

Currently, Tool support only English language.

passha's People

Contributors

curious-odd-man avatar lyubick avatar

Stargazers

 avatar

Watchers

 avatar  avatar

passha's Issues

Windows clipboard remembers passwords

Windows have clipboard history.

https://www.howtogeek.com/671222/how-to-enable-and-use-clipboard-history-on-windows-10/

Although it could be disabled - user might want it to be enabled or user can be unaware that it is enabled.

The problem is that if user used clipboard to copy/paste password - it will be saved in the clipboard history.

To reproduce:

  1. Open pasSHA UI and copy password using CTRL + C
  2. Verify immediately that you can paste it.
  3. Wait for the clipboard timeout to pass and verify that password is no longer in clipboard.
  4. Press WIN + V. The clipboard history will be shown with a password in it.

Since we're caring about clearing the clipboard after a timeout we could also care to cleaning up a history.

Refactoring. Get rid of XC in Exceptions

  • Replace XC with exceptions.

  • Modules in a lower level should throw low level exceptions. If module on a higher level catches low level exceptions it should be wrapped with higher level exception as a cause. For example if Database creation should throw exception CreateDatabaseError exception, while it can be cause by either PermissionDenied, FileNotFound or any other lower level exception.

Feature. Loading passwords file looks like freeze.

When you enter master password it takes long time to load database - it looks like freeze.

It would be really great to see progress bar showing the progress of loading and keep UI responsive same time (be able to move window).

P.S. I can implement it, but I can't compile and run project because javafx is missing and should be added as dependency.

RSA update.

Migrate to RSA-4096, also review whole algorith and prime number generation.

After minimize application could not be restored.

Definition of Done

  1. After minimize, Application should restore at the same coords
  2. After close, Application should restore at the same coords

RCA: Bug occurs due to JavaFX framework causes stage.X & .Y change upon press of minimization button, despite if we are catching an event.

Refactoring. Abstractions everywhere.

  • Get rid of Vector and any other old data structures.

  • Try and use as much as possible generic collections, rather then specific implementations, where possible. In general for parameters and fields it's better to have the most generic type possible. For example: method that only iterates elements should receive Iterable<X> instead of any collection, like List<X>.

Refactoring. Replace Logger with library

  • Replace our homemade logger with a library Log4j2.

  • Create configuration for the users. I suggest having circular logging to files.

  • Create template configuration for developers. I think best to have 2 outputs.

  1. Async output to file with lowest log level output. Circular logging to files.
  2. Sync output to console. Default level to be INFO. Developers then can alter the level as they need. Default pattern can be same as we have currently.

Refactoring. Use dependency inversion

Given:

class B {
    private A a;
}

Instead of having:

class A {
}

Should have:

interface A {
}

class X implements A {
}

Additionally class B should not instantiate A or X.
Class B should either receive A in a constructor or through setter.

This will decrease coupling and allow testing separately different components.

Login visuals can be improved

It is more more cooler now, but could we implement this:

  • Write stages - Key generation, Password loading etc.
  • Approx. estimation of completion based on some metrics

Refactoring. Avoid Object...Stream

  • Instead of saving Java objects using Object stream use JSON.

  • Jackson library can be used to easy POJO conversion into JSON string and backwards.

  • Re-design user data file. I think it is better to use have one JSON object (encrypted of course) that holds different fields (including all passwords). @lyubick please comment on that.
    Also I think it would be better to have binary instead of text file for passwords.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.