Backup and Sync

BlueSpectre

As a cybersecurity professional, I think the concept of Spectre (Master Password) is good. A secure system for generating passwords has numerous advantages over password managers that store saved passwords. But a fundamental problem I've had is that there needs to be a good way to both automatically backup and sync enough details about a user profile to re-create that profile. Nobody can remember the choices they made for each site in terms of (1) password type (e.g., max, phrase, long, etc.), (2) count, and (3) login name type for dozens or hundreds of sites.

Spectre should have an option to automatically backup the following values to a cloud service of the user's choice:

Spectre username
- [optional] Spectre user avatar
Site Name
- Algorithm Version
- URL
- Password Type
- Count
- Login Name Type
- [optional] Security Questions
- [optional] Last Used
- [optional] Total Uses

lhunath

BlueSpectre

Hi!

Thank you for raising this concern. There is a valid need here.

That said, there are several reasons as to why Spectre will not be performing tight integration with third-party services. Some of these reasons include but are not limited to:

Spectre's code-base needs to remain unencumbered by executable binary code from external vendors which we have no direct control over.
Spectre seeks primarily to be 100% free software and we want its license to remain fully GPL compatible.
Spectre does not want to tie itself to external parties or be seen to condone or be selective of any vendors.
Spectre is deliberately orthogonal to stateful solutions and does not want to be seen encouraging a slippery slope back into them.

That said, Spectre is very intentional about seeking to empower its users. It is for this reason that Spectre was engineered from the ground up using a standardized JSON file-based storage system (as opposed to Master Password's CoreData implementation, for instance). The idea being that it should be easy for users to access Spectre's state for inspection as well as for backup and control.

You can already export your user to obtain this JSON file in a way that you can save it to another app on your phone (eg. a cloud storage app of your choice). Similarly, you can import an mpjson file from any source back into Spectre to update your Spectre user with it. Of course, Spectre's users and sites will also be backed up along your regular iPhone backups, whether you choose to back up to Apple's iCloud or directly to your computer.

That said, I do recognize that this process isn't exactly conducive to enabling easy access and is a bit of a manual and tedious process if you want to do this on a consistent basis.

I will be looking into ways of exposing your user's state more directly, likely through the iTunes File Sharing system.

Feel free to use this thread to discuss or provide additional feedback.

ledsunefo

I honestly think having automatic backup defeats the entire purpose of this app. If someone wants that type of feature, what is stopping them from simply using a provider such as BitWarden or KeyPass where those applications were designed with that described use case in mind.

To me the inconveniences of this app is part of the security.

Manually exporting and carefully encrypting and storing gives users freedom and piece of mind. This is similar to the amount of care that needs to be taken if someone keeps there own encryption keys. It's inconvenient but you know whats going on.

I'm no security professional by far but my senses tell me automatic anything relating to security comes at a cost of security.

With all that said I'm one for always trying to find a solution and flexiblity for as many different use cases.
One idea I have is perhaps there is a way to setup a Script that can interface with Spectre where it can automatically do the manual export periodically to the directory of your choice. Based on a Calendar event on your machine. For instance MacOS has Automator. Then from there you could choose the directory that is attached to the cloud storage provider of your choice.

ledsunefo

I'm totally aware that my mentioned scripting idea is also not secure at all because the script would have access to your Secret Key but at least its local and not happening on a server somewhere. It all depends on what one is comfortable with. Like I said I'm no security professional nor expert. I'm just a regular degular person.

lhunath

What I'm experimenting with at this stage is exposing users via Apple (iTunes or Finder) file sharing as well as in-place file opening.

These experiments are currently available through Login to see the code.

File Sharing

An option is added on a per-user basis that allows you to expose that user through file sharing:

Doing so will reveal the file either through the Login to see the code app on your iPhone, or by connecting the phone to a computer and opening iTunes or Finder:

You can now operate on this file to copy it elsewhere, back it up, or view it.

This only works one-way right now: changes to the shared file will not reflect inside Spectre. Allowing exposed users to be modified freely would likely create a security problem.

In-place Opening

With in-place opening, you can store your Spectre user files outside of the Spectre app in a file storage application of your choice, and sign into that external file by tapping it from your external app. Spectre will open and sign into the user while keeping it in your external app. Any changes to the user will be saved to the external app.

This is currently incompatible with AutoFill, since AutoFill is a Spectre application extension and cannot access your third-party application storage at will.