Hello dear friends.
Over the past couple of years I received messages from many websites were I've been registered to which have been hacked exposing personal details. Names like eBay, but many more...
I decided the best way to keep myself safe was to have a file will all my random generated passwords for every site, perhaps stored in some kind of usb flash memory using arduino (I only need a few Kb) that would split the data as text, similarly to a keylogger, upon entering a password. The flash is protected and a couple of tries with the wrong access password would lock the device permanently. Any suggestions where to start to build such a device?
Or perhaps a better idea altogether, who knows?
Thanks
archive the text file in an encrypted .zip on the usb. Remember only the zip file password. Unrelated to arduino
It should be fairly easy to remove the password on a zip file, Ive done it a few times before.
I would need something that is either hardware encrypted or at least not accessible by the PC; something where the data can self destruct if the wrong password is entered more than 3 times.
This is common on encrypted drives, problem is some require software on the windows computer (therefore ruling out a smartphone) and the ones with a built in keypad/fingerprint scanner are generally very, very expensive.
So going back to the original question: I guess what I want is something that:
a) can receive a file trough windows (acts as a usb storage but only one way)
Any USB storage library for arduino?
b) requires a password to be entered on a keypad before allowing the data to be acessed
This should be fairly easy
c) acts as a USB keypad of some sort to output data to a terminal/text application.
Perhaps a leonardo could be used for this?
... because? anyway you-re out of luck there-s no hardware encryption on arduino. There are encryption libraries but that doesn't make it "hardware"
...and you don't want to delete a master password file after 3 failed attempts. maybe your kids are having fun
The PC you don't want to manage the password file will read cleartext password from the "arduino keyboard". If it's hacked will get your password anyway. That's what spyware does - intercepts keyboard input
travis_farmer:
Sparkfun Encryption Hardware
~Travis
That's nice. not helpful if retrieved password from fancy shield is sent as clear usb keyboard code to pc.
The matter is encryption system in current browsers is well designed. The most practical and simple way that a strong ebay/facebook/google/etc.. password be hacked is to intercept keyboard code on user's PC/tablet/phone.
Anroid/Iphones are safer than your device.. if not rooted. Keep encrypted file on your unrooted phone, is safer. If you don't trust a PC, then don't login by typing password on it's keyboard - whether you do it yourself or you ask an arduino to do it.
blimpyway:
The PC you don't want to manage the password file will read cleartext password from the "arduino keyboard". If it's hacked will get your password anyway. That's what spyware does - intercepts keyboard input
Quite true. Ill be ruling out that - If not sure just plug it into my smartphone. The important thing is having a drive that is protected and self destructs in case it is lost.
I know some computers do keep a cached copy of opened documents on memory/temp files, so the option to gather it as a text file from a usb drive (rather than keyboard) doesn't seem that appealing either.
Besides, with the keyboard, I can enter password followed by some number. For example 12345 -5 opens up arduino forum password, 12345 - 6 opens up instructables.com and so on: Even if the computer is hacked this limits the amount of data the hacker can get, versus dumping a whole file.
The fact I'm using a USB drive also protects me from a hardware keylogger attached to the machine keyboard.
Unfortunately 100% protection is very unlikely, but I trust this would minimize the risks quite considerably.
Since OP thought that just by hardware encryption would be safest, is obvious it wasn't a concern .
That kingston stick needs hardware encryption for speed not for safety. An AES arduino library implements exactly the same encryption standard, just slower.
Once you plug it in a compromised computer, it will be able to copy everything from the stick after you key-in the pin code.
blimpyway:
Since OP thought that just by hardware encryption would be safest, is obvious it wasn't a concern .
That kingston stick needs hardware encryption for speed not for safety. An AES arduino library implements exactly the same encryption standard, just slower.
Once you plug it in a compromised computer, it will be able to copy everything from the stick after you key-in the pin code.
Spot on blimpyway.
Hardware can make sense for a 16GB drive, but just for the sake of a few KB, software would work out just as useful. The idea here is that coding and decoding is not done on the host PC to avoid having to install software and also because I can set it up so as to access particular passwords rather than dumping the whole file on a compromised computer.
So in effect, the arduino solution would be a bit safer than a flash drive which is completely unlocked once the password has been entered. I just move the cursor to the password field, enter the code and voila. Get it wrong and the drive self formats.
If the AVR's flash program could be fused unreadable, then there is no need for other hardware. Passwords can be encrypted in eeprom with an unreadable PROGMEM key + library in arduino's flash.
If not, additional hardware is in most cases useless - arduino program that talks with "safe" hardware can be read, decoded, overridden. as any other PC, tablet or arduino program
blimpyway:
If the AVR's flash program could be fused unreadable, then there is no need for other hardware.
Yep that's the idea - Fuse locked = No access to flash. The only way the arduino would spit the data was if the right code was entered using a keypad on the device itself.
Its seems quite safe on my view. And cheap as well 
I just read about AVR lock bits. You can actually prevent program memory read and/or write by seting avr lock fuses. That would allow you to save encrypted passwords in eeprom, and keep master key in progmem.
There are different topics discussing unlocking an avr chip but it seems it`s quite difficult, should be safe enough for your password keeper.
