John Turner

Results 73 comments of John Turner

Improve security with rolling Challenge-Response, HMAC into Scrypt function

@TomAtYubico I have spent a fair amount of time looking at the KeePass plugin code and if anyone can tell me I am wrong I would love to hear a...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

I can later today, the important thing to notice here however is that KeeChallenge never gets access to the MP and therefore would need to ask for another one from...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

Im not sure, I stopped using KeepassXC cause it had poor browser integration and KeeAgent is just a little more convenient than the one they setup

Improve security with rolling Challenge-Response, HMAC into Scrypt function

@strangeflower I am not nearly as much of an artists as you are however ![untitled diagram](https://user-images.githubusercontent.com/7612064/42255536-40cf317c-7f1a-11e8-8349-05a812e20c4b.png) Here is my terrible diagram, Important differences is that in the new scheme the...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

I would need to look at the api more however my understanding is that all secret changes would require the change password dialog. However replacing the AES function could easily...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

So this presents an interesting challenge, you cannot reencrypt the database in my checking without doing a password change meaning every time you save the database you must input both...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

So yes, one implementation would require a master password +yubikey + yubikey password(challenge) every save of the database and has the upside of not requiring a secondary xml file. A...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

Yes, but due to restrictions you would need to enter the password twice or just use the yuibkey without a "master" password

Improve security with rolling Challenge-Response, HMAC into Scrypt function

Technically their source code is at https://keepass.info/download.html I have not implemented either yet was waiting to see what wins out but I can implement the form to request the "password"...

Improve security with rolling Challenge-Response, HMAC into Scrypt function

>I remember looking into this a few months ago, and the people over at the SourceForge repo for KeePass didn't seem interested in implementing Yubikey natively. I hope things change,...