[Question] is PfP compatible with an equivalent Android app ?

[gotgot1995]

Hi, I'm looking for an easy way to retrieve my passwords directly from my Android smartphone.

I found this app SecUSo/privacy-friendly-passwordgenerator which is very user friendly. Although from what I read and from my experience, it looks both projects are using the same algorithm but differently, which doesn't generate the same passwords.

I'm going to look into the code to see what I can edit in order for the two apps to be compatible.

[palant]

No, this application is not compatible with PfP. I'd also advise against using it, there is a number of obvious signs that the author doesn't understand the crypto involved. The obvious issues are:

• The algorithm combines PBKDF2 and Bcrypt. With the former being a considerably weaker algorithm, this is absolutely pointless.
• Only the number of PBKDF2 iterations can be adjusted, whereas Bcrypt rounds are fixed and cannot be configured.
• The number of PBKDF2 iterations can be set to a value between 1000 and 10000, with 2000 being the default. Even the highest possible setting here is far too low (see my blog post).
• The number of bcrypt rounds is fixed at 10 which is not too bad (at least a lot better than the PBKDF2 setting) but not ideal either.
• The app allows selecting the hash algorithm to be used with PBKDF2 which has no security impact and merely confuses users.

Finally, a note: this might not be obvious, but passwords generated by this app are device-specific. So if your device crashes, you won't have any way of recovering your passwords.

[gotgot1995]

Well thank you very much for your analysis and note.

I guess that in order to fully enjoy using this app on my smartphone, I'll just package PfP inside an Android webview ^^

Good day to you.

[palant]

Feel free to do that. It's the same goal with #91, merely that the idea was adding a few improvements to make this more comfortable.