I want to develop an external password manager, like a master key that I would carry around in my pocket and use across multiple devices.
This is something I’ve wanted to do for a long time, but haven’t been able to justify making the time for, so I wanted to put this out there and see if anyone would be interested in helping to develop a circuit. Time isn’t necessarily a factor, it would just be nice if it could progress little by little.
I’m imagining an approximately phone-sized, or smaller, electronic device that has a USB port that can be plugged into a computer to send a stream of keypresses. So it would need a map of a circuit for some sort of key table, maybe like an ASCII table, and a hard drive and operating system, and whatever else, ram, etc.
It would maybe be best to accept a USB keyboard as input so that typed passwords could be saved. It would also be nice if non-predictable passwords could be randomly generated based on a set of given parameters, like a length range and types of characters to include or exclude.
For me, it would be important to prevent the device’s hard drive from being accessed by the computer it’s plugged into, so I want to have a separate input USB and output USB port, and some way to restrict the direction of data, maybe using diodes. Or maybe it would be ok if one of the ports was bidirectional, as long as the output port was unidirectional.
Other security measures would be ideal, like a password for the device itself, although, for a prototype, I would be fine with keeping the device in my pocket. A cage would be nice to prevent some kind of wireless scanning. And I wouldn’t want any kind of wireless capability like wifi or bluetooth, I think a direct connection would be the most secure thing.
There are some similar products on the market, but there are a few reasons I wouldn’t want to use them. Of course many people use software password managers, but I feel like this is analogous to keeping your money on the living room table. Once someone breaks in they can gain access to the password manager. Also I want to use one key for multiple devices.
There are also hardware password managers, but I get nervous about them as well. Mainly, because data seems to always be transferred bidirectionally. Secondly, I don’t necessarily trust the manufacturers, or I don’t trust that the device itself isn’t hackable. Also, they sometimes are accessed by their own software, which is another avenue by which they can be compromised. Maybe something else I should’ve mentioned is that the device’s (open) OS should either be read-only or be restorable by the user in case it does get compromised. And the hardware used should be the minimum for what’s required to prevent something like a virtual layer or malware that packs data into some kind of pocket.