1

I intend to write a program that works a bit like a password manager and i would like to create a way to (in addition to standard password+username) is going to serve as log in. I have a unique code that is stored in a data file in the pen drive but if someone copies it to another pen it would still work. I would like to fix this obvious security issue. How would I go about to do this? Maybe encrypting the file with some property of the pen drive? I was using last modification time with 0 results.

2 Answers 2

2

Unfortunately, most of pen drives are not identifiable uniquely. What you can use is volume ID but it can be copied easily as well.

I can see at least two options:

a) Protect file on the pen drive with a password (just encrypt the file using i.e SHA256 AES256, sorry and when its accessed request the password from user and decrypt the content of the file you need).

b) use secure pen drives such as CryptoSticks or software protection dongles.

4
  • that's sad :/ a) could work though will do some research about that May 26, 2017 at 14:58
  • its just two operations before you read it and before you write it ;) It would work like: 1) is there file on flash? 2) read file 3) ask for password 4) decrypt readed buffer. The opposite way is: 1) ask for password, 2) encrypt buffer with password, 3) store file on thumb drive.
    – Fis
    May 26, 2017 at 15:02
  • Yes the simple implementation is a major plus May 26, 2017 at 15:04
  • Please note I ment AES256, not SHA
    – Fis
    May 26, 2017 at 15:10
1

Are you creating a password manager? If so, Why are you rolling your own password manager? There are many on the internet that are likely to be more secure than one you create. If not then the below still applies.

If you are though looking for a function that you can run to 'recover' a password then why use a unique stored code that could (as you point out) be copied?

Why not use a hash function where by you use site name and email address, plus a pass phrase together? Ideally it would be a little more than that, you would want to possible add a little more entropy. But what I am saying is that way it's all in your head and repeatable whenever you need the password.

You could even have part of the code on the USB and the need to manually enter the other part each time to form the master key.

10
  • Mostly because I can't really use someone's else manager in this machine. And that is actually the thing here. even if you do have the pen drive you would have to know the username + password combo. It is just meant to be an extra layer. So i really can't create a file that cannot be copied from a pendrive to another without messing it up? May 26, 2017 at 14:44
  • The problem is the contents of the pen drive needs to be accessed by the application. I really don't think what you are proposing sounds a good idea. If you must do your approach then make sure your function takes the password/pass pharse in addition to the code. That way the code is useless without the added password.
    – ISMSDEV
    May 26, 2017 at 14:46
  • Don't Pen drives have some type of unique code i can access? i was planing on using the number of bytes in the capacity to encrypt it but that would be somewhat unique but easy to forge May 26, 2017 at 14:53
  • 1
    I think you are attempting to try and outsmart an attacker with elementary 'hidden' methods. If you are that worried about someone copying the data and being motivated to attack you, they will break your 'secret algorithm'. If you must keep the code on the USB key (which the attacker I guess would just steal anyway) then why not use a hardware based encrypted USB key?
    – ISMSDEV
    May 26, 2017 at 15:07
  • 1
    I totally get why you are trying to achieve it. I will watch other replies and see what others come up with. But in essence if you keep a secret stored it is a target for being stolen/copied. I really think you want your master password in your head in your example. :D
    – ISMSDEV
    May 26, 2017 at 15:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .