0

mSecure is a password manager and the company has recently released their latest version (v5) that uses their own servers to store and sync user data.

Some people are concerned about how they are securing user data and mSecure provided this description

when you first sign up for an account, we generate a super secure password mentioned above that we call an “Account Key.” We then take a known piece of text (it doesn’t really matter what the text is, but it happens to be a copyright notice) and encrypt it with your account key. The encrypted text is then stored in your cloud account. To be clear, this is not the account key itself; it’s a known piece of text that has been encrypted with the account key. We then encrypt the account key with your master password – the password you use to unlock the app – and store it in the mSecure database locally on your device. We then send you an “mSecure Authentication” email that contains your account key, which is required to authenticate you as the owner of your account.

Your account key is not stored in the mSecure Cloud.

When you log into mSecure on your device, it reads the account key out of your local database and decrypts it with your master password. This is why you don’t need to use the QR code each time you launch mSecure. When you want to install and use mSecure on a new device, we require you to sign in with your email and master password then ask you for the QR code. mSecure reads in the account key from the QR code, decrypts the data in the code with your master password then downloads the known piece of text mentioned earlier from your cloud account. Once the known piece of text is downloaded, mSecure attempts to decrypt it with the account key, and, if the decryption is successful, downloads the rest of your data that is also encrypted with your account key from the mSecure Cloud. After the data is downloaded from your cloud account, it can now be decrypted with the account key locally on your device.

Does this sound reasonable, or are there points that are of concern, such as the “mSecure Authentication” email that contains your account key which they claim isn't an issue as it's already encrypted?

1

Is it reasonable? Yes. Is it secure? I can't tell.

I can't tell because security is in the details. The general idea is good but if you badly implement any part it could be insecure, even if the idea was good. So let's focus on the idea here.

Their encryption scheme is based on two parts. A part that you know, the master password, and a part that you own, the account key/email address. Basically, from a security point of view, the account key and the email are nearly the same thing here. If you have access to the email you can get the account key and if you have access to the account key then you don't need access to the email.

In conclusion, what they are trying to say is that they are using two factor authentication. Instead of using a phone for two factor authentication or another device that you carry around they are using the account_key and email as the second factor. I don't see anything wrong with this idea.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.