2015-2016, Fallon Turner fcturner@users.noreply.github.com
This app cannot be installed from within ownCloud, since this system demands repackaging of releases and kills the possibility to freely use GitHub master versions.
This is a Password Manager for viewing, editing, categorizing and generating passwords (see 'img'-folder for screenshots) in ownCloud. It features both client side and server side encryption (using combined EtM [Encrypt-then-MAC] and MCRYPT_BLOWFISH encryption with user-specific, ownCloud-specific, and database entry-specific data), where only the user who creates the password is able to decrypt and view it. So passwords are stored heavily encrypted into the ownCloud database (read Security part for details). You can insert or import your own passwords or randomly generate new ones. Some characters are excluded upon password generation for readability purposes (1, I, l and B, 8 and o, O, 0).
This app is primarily intended as a password MANAGER, e.g. for a local ownCloud instance on your own WPA2 protected LAN. If you trust yourself enough as security expert, you can use this app behind an SSL secured server for a neat cloud solution. The app will be blocked (with message) if not accessed thru https, which will result in your passwords not being loaded (decrypted) and shown. To prevent this, use ownClouds own 'Force SSL'-function on the admin page, or use HSTS (HTTP Strict Transport Security) on your server. Also, make sure your server hasn't any kind of vulnerabilities (POODLE, CSRF, XSS, SQL Injection, Privilege Escalation, Remote Code Execution, to name a few).
The script for creating passwords can be found in /js/script.js.
Generated passwords are in fact pseudo-generated (i.e. not using atmospheric noise), since only the Javascript Math.random-function is used, of which I think is randomly 'enough'. After generation of different types of characters (your choice to include lowercase, uppercase, numbers and/or reading marks, strength will be calculated), scrambling of these characters is done using the Fisher-Yates shuffle (also known as Knuth, a de-facto unbiased shuffle algorithm).
This app features both server-side encryption (since encryption takes place on the server, before the data is placed in the database table) and client-side encryption (since encryption is performed with a key that is not known to the server). All passwords (generated or your own) are stored into your own ownCloud database, using these high-end cryptological functions:
- Encryption is done using a key built from user-specific, ownCloud-specific, and database entry-specific data so it is unique for every encrypted block of text (i.e. every password). It therefore provides key rotation for cipher and authentication keys.
- The keys are not used directly. Instead, it uses key stretching which relies on Password-Based Key Derivation Function 2 (PBKDF2).
- It uses Encrypt-then-MAC (EtM), which is a very good method for ensuring the authenticity of the encrypted data.
- It uses mcrypt to perform the encryption using MCRYPT_BLOWFISH ciphers and MCRYPT_MODE_CBC for the mode. It's strong enough, and still fairly fast.
- It hides the Initialization vector (IV).
- It uses a timing-safe comparison function using double Hash-based Message Authentication Code (HMAC) verification of the source data.
All passwords are encrypted with user-specific, ownCloud-specific and server-specific keys. This means passwords can be decrypted:
- only by the user who created the password (so this user must be logged in),
- only on the same ownCloud instance where the password was created in (meaning: same password salt in config.php).
Other users or administrators are never able to decrypt passwords, since they cannot login as the user (assuming the user's password isn't known). If the password salt is lost, all passwords of all users are lost and unretrievable.
There is a built in option to view website icons in the password table. This can be set by the administrator on the settings page of ownCloud. The admin has two services to choose from: DuckDuckGo (default) and Google. Icons are downloaded from their secured server when a user loads the page. Nothing fancy or unsafe (even using Google... although they track you), it's just about icons. The icon for the ownCloud's website for example (replace owncloud.org with your own domain to try):
- https://icons.duckduckgo.com/ip2/owncloud.org.ico (32x32 pixels)
- https://www.google.com/s2/favicons?domain=owncloud.org (16x16 pixels)
Download this latest release and copy the folder 'passwords' to /owncloud/apps/ (remember that the folder must be called 'passwords'). Login as admin and enable the app. The database tables oc_passwords and oc_passwords_categories will be created automatically (assuming _oc as prefix).
View this app on apps.owncloud.org.
I would like to thank Anthony Ferrara (ircmaxell), for teaching the world how to properly set up security in PHP.