2015-2016, Fallon Turner [email protected]
View this app on apps.owncloud.org.
This app cannot be installed from within ownCloud, since this system demands repackaging of releases and kills the possibility to freely use GitHub master versions. (read more below under Installation)
📷 More pictures in the gallery.
📷 More pictures in the gallery.
This is a Password Manager for generating, SHARING, editing, and categorizing passwords in ownCloud 8 and ownCloud 9 (see 'img'-folder for screenshots or here for the gallery). It features both client side and server side encryption (using combined EtM [Encrypt-then-MAC] and MCRYPT_BLOWFISH encryption with user-specific, ownCloud-specific, and database entry-specific data), where only the user who creates the password is able to decrypt and view it. So passwords are stored heavily encrypted into the ownCloud database (read Security part for details). You can insert or import your own passwords or randomly generate new ones. Some characters are excluded upon password generation for readability purposes (1, I, l and B, 8 and o, O, 0).
This app is primarily intended as a password MANAGER, e.g. for a local ownCloud instance on your own WPA2 protected LAN. If you trust yourself enough as security expert, you can use this app behind an SSL secured server for a neat cloud solution. The app will be blocked (with message) if not accessed thru https, which will result in your passwords not being loaded (decrypted) and shown. To prevent this, use ownClouds own 'Force SSL'-function on the admin page, or use HSTS (HTTP Strict Transport Security) on your server. Also, make sure your server hasn't any kind of vulnerabilities (POODLE, CSRF, XSS, SQL Injection, Privilege Escalation, Remote Code Execution, to name a few).
The script for creating passwords can be found in /js/script.js.
Generated passwords are in fact pseudo-generated (i.e. not using atmospheric noise), since only the Javascript Math.random-function is used, of which I think is randomly 'enough'. After generation of different types of characters (your choice to include lowercase, uppercase, numbers and/or reading marks, strength will be calculated), scrambling of these characters is done using the Fisher-Yates shuffle (also known as Knuth, a de-facto unbiased shuffle algorithm).
This app features both server-side encryption (since encryption takes place on the server, before the data is placed in the database table) and client-side encryption (since encryption is performed with a key that is not known to the server). All passwords (generated or your own) are stored into your own ownCloud database, using these high-end cryptological functions:
- Encryption is done using a key built from user-specific, ownCloud-specific, and database entry-specific data so it is unique for every encrypted block of text (i.e. every password). It therefore provides key rotation for cipher and authentication keys.
- The keys are not used directly. Instead, it uses key stretching which relies on Password-Based Key Derivation Function 2 (PBKDF2).
- It uses Encrypt-then-MAC (EtM), which is a very good method for ensuring the authenticity of the encrypted data.
- It uses mcrypt to perform the encryption using MCRYPT_BLOWFISH ciphers and MCRYPT_MODE_CBC for the mode. It's strong enough, and still fairly fast.
- It hides the Initialization vector (IV).
- It uses a timing-safe comparison function using double Hash-based Message Authentication Code (HMAC) verification of the source data.
All passwords are encrypted with user-specific, ownCloud-specific and server-specific keys. This means passwords can be decrypted:
- only by the user who created the password (so this user must be logged in),
- only on the same ownCloud instance where the password was created in (meaning: same password salt in config.php).
Other users or administrators are never able to decrypt passwords, since they cannot login as the user (assuming the user's password isn't known). If the password salt is lost, all passwords of all users are lost and unretrievable.
For sharing, an ad hoc share key is created everytime a share is initiated. This is a 256-bit strong hash, with no retrievable information. The share key is stored encrypted as above for the user who shares a password and copied to another table where this key matches the password ID and the ownCloud ID of the user to whom the password is shared with. If the share keys match, the password will be decrypted at the receiving user's side too. If they don't, the receiving user will see an 'Invalid share key' notice and the password will not be decrypted at all.
This app allows full remote control by using a RESTful API. Read here about how to use it: https://github.com/fcturner/passwords/wiki.
Browser plugins are available for Firefox here (thanks to @eglia) and for Chrome here (thanks to @thefirstofthe300).
There is a built in option to view website icons in the password table. This can be set by the administrator on the settings page of ownCloud. The admin has two services to choose from: DuckDuckGo (default) and Google. Icons are downloaded from their secured server when a user loads the page. Nothing fancy or unsafe (even using Google... although they track you), it's just about icons. The icon for the ownCloud's website for example (replace owncloud.org with your own domain to try):
- https://icons.duckduckgo.com/ip2/owncloud.org.ico (32x32 pixels)
- https://www.google.com/s2/favicons?domain=owncloud.org (16x16 pixels)
Use one of the following options, login as admin on ownCloud and enable the app. The database tables oc_passwords, oc_passwords_categories and oc_passwords_share will be created automatically (assuming _oc as prefix).
- Manual download and installation
- Click here to view the latest official release or, for the very last master version, click here to download the zip or here to download the tar.gz.
- Copy, unzip or untar the folder 'passwords' to /owncloud/apps/ (remember that the folder must be called 'passwords').
- Git clone
- Use the command
git clone https://github.com/fcturner/passwords.git /var/www/owcloud/apps/passwords
(assuming /var/www/owcloud as your ownCloud root location).
- ownCloud App store
- I refuse to support this. This system demands repackaging of releases and kills the possibility to freely use GitHub master versions. Repackaging of releases is prone to human error and, more importantly, adds invisible system files to a release when doing this on Mac (like
.DS_Store) and Windows (likeThumbs.db). This means local user properties and file system info (privacy sensitive possibly) are sent to a server, which should be avoided at all costs. Did you know forensic scientists can use these files against you? You surely don't want them on any server, any cloud, or anywhere on the internet! Dr Sarah Morris and Dr Howard Chivers wrote an article about this. The ownCloud team should really alter the behaviour of ownCloud pulling apps from their app store, instead of letting app developers interfere with a decent, solid and closed GitHub workflow (as I've been telling them for months). This app is all about privacy and security, the ownCloud app store apparently isn't.
A big thanks to all participants in this project. I thank Anthony Ferrara (ircmaxell), for teaching the world how to properly set up security in PHP.