Backup and Sync

BlueSpectre

As a cybersecurity professional, I think the concept of Spectre (Master Password) is good. A secure system for generating passwords has numerous advantages over password managers that store saved passwords. But a fundamental problem I've had is that there needs to be a good way to both automatically backup and sync enough details about a user profile to re-create that profile. Nobody can remember the choices they made for each site in terms of (1) password type (e.g., max, phrase, long, etc.), (2) count, and (3) login name type for dozens or hundreds of sites.

Spectre should have an option to automatically backup the following values to a cloud service of the user's choice:

Spectre username
- [optional] Spectre user avatar
Site Name
- Algorithm Version
- URL
- Password Type
- Count
- Login Name Type
- [optional] Security Questions
- [optional] Last Used
- [optional] Total Uses

lhunath

BlueSpectre

Hi!

Thank you for raising this concern. There is a valid need here.

That said, there are several reasons as to why Spectre will not be performing tight integration with third-party services. Some of these reasons include but are not limited to:

Spectre's code-base needs to remain unencumbered by executable binary code from external vendors which we have no direct control over.
Spectre seeks primarily to be 100% free software and we want its license to remain fully GPL compatible.
Spectre does not want to tie itself to external parties or be seen to condone or be selective of any vendors.
Spectre is deliberately orthogonal to stateful solutions and does not want to be seen encouraging a slippery slope back into them.

That said, Spectre is very intentional about seeking to empower its users. It is for this reason that Spectre was engineered from the ground up using a standardized JSON file-based storage system (as opposed to Master Password's CoreData implementation, for instance). The idea being that it should be easy for users to access Spectre's state for inspection as well as for backup and control.

You can already export your user to obtain this JSON file in a way that you can save it to another app on your phone (eg. a cloud storage app of your choice). Similarly, you can import an mpjson file from any source back into Spectre to update your Spectre user with it. Of course, Spectre's users and sites will also be backed up along your regular iPhone backups, whether you choose to back up to Apple's iCloud or directly to your computer.

That said, I do recognize that this process isn't exactly conducive to enabling easy access and is a bit of a manual and tedious process if you want to do this on a consistent basis.

I will be looking into ways of exposing your user's state more directly, likely through the iTunes File Sharing system.

Feel free to use this thread to discuss or provide additional feedback.

ledsunefo

I honestly think having automatic backup defeats the entire purpose of this app. If someone wants that type of feature, what is stopping them from simply using a provider such as BitWarden or KeyPass where those applications were designed with that described use case in mind.

To me the inconveniences of this app is part of the security.

Manually exporting and carefully encrypting and storing gives users freedom and piece of mind. This is similar to the amount of care that needs to be taken if someone keeps there own encryption keys. It's inconvenient but you know whats going on.

I'm no security professional by far but my senses tell me automatic anything relating to security comes at a cost of security.

With all that said I'm one for always trying to find a solution and flexiblity for as many different use cases.
One idea I have is perhaps there is a way to setup a Script that can interface with Spectre where it can automatically do the manual export periodically to the directory of your choice. Based on a Calendar event on your machine. For instance MacOS has Automator. Then from there you could choose the directory that is attached to the cloud storage provider of your choice.

ledsunefo

I'm totally aware that my mentioned scripting idea is also not secure at all because the script would have access to your Secret Key but at least its local and not happening on a server somewhere. It all depends on what one is comfortable with. Like I said I'm no security professional nor expert. I'm just a regular degular person.

lhunath

What I'm experimenting with at this stage is exposing users via Apple (iTunes or Finder) file sharing as well as in-place file opening.

These experiments are currently available through 3.0-ios-alpha.13.

File Sharing

An option is added on a per-user basis that allows you to expose that user through file sharing:

Doing so will reveal the file either through the Files app on your iPhone, or by connecting the phone to a computer and opening iTunes or Finder:

You can now operate on this file to copy it elsewhere, back it up, or view it.

This only works one-way right now: changes to the shared file will not reflect inside Spectre. Allowing exposed users to be modified freely would likely create a security problem.

In-place Opening

With in-place opening, you can store your Spectre user files outside of the Spectre app in a file storage application of your choice, and sign into that external file by tapping it from your external app. Spectre will open and sign into the user while keeping it in your external app. Any changes to the user will be saved to the external app.

This is currently incompatible with AutoFill, since AutoFill is a Spectre application extension and cannot access your third-party application storage at will.

Tskl

Hi, hope this forum is not dead. Almost a year since the last entry.
I'd like to see a way to sync with versions, sites as encrypted jason by webdav, dropbox, icloud or what have you in midn please. It it bothering me to copy and import the various users from ipad, pc, mac and iphone like a cavemen. Please help.

lhunath

@Tskl Thank you for sharing.

If you have Spectre Premium enabled, you are able to place your user in a cloud app, such as Dropbox, but it is not as convenient as keeping your user in Spectre itself, since you will need to open your Spectre user from your cloud app each time.

Keep in mind that Spectre's goal is to help you become INdependent from storage. As such, relying on syncing in any way is a signal that you are making yourself vulnerable to that syncing solution. This is why Spectre tries to recommend that you try thinking about passwords differently – not in a sense that you have an app which has all your passwords in it. Instead, think about it like an app that you can use to get any password, even if it isn't in there yet, just by adding it. You do not need to keep your apps in sync, if you ever need a password for a site that is missing, you just add it and the password will be right there.

Tskl

Thank you. I‘m looking for comfort. Specter lacks a lot of comfort. No sync is a big one. I want to use the system and think differently about passwords. But part of the system is to take some burden of my shoulders and be helpful with passwords. I find it complicated to share the password version three for some sites and others on version one. Got locked out multiple times from services. No comfort makes me leave soon. I like the idea but want my live back not Bein invested to think about the passwords hard.
Keep up the work. Btw did you read the articles in ct masterpassword/Spectre criticism?
Btw typing this past my time and the sound feedback on typing on iOS 16.3 is very loud. Super annoying. Sorry for the rant.

lhunath

Thank you again for that feedback. I do agree with you that there is some room for additional comfort with regard to passwords when you need to increase the counter for a site.

We are investigating possible technology to solve for this in the future without compromising our core values of making people independent of third parties, especially cloud storage providers.