Added a cryptographically strong random password generator dialog to the slot editor, launched via a button next to the password field.
Rationale
The clipboard is a dangerous place for high-security passwords, especially when using remote desktops and virtual machines. Clipboard contents are readily available in cleartext to all local processes - even without admin rights. Furthermore, the clipboard is often synchronized with remote desktop clients and virtual machines - Linux, Windows and Android-based.
Windows 10 and 11 and some Android versions provide clipboard history and cross-device synchronizing... sometimes by default. The security around this clipboard history is dubious and ill-defined.
Considering the extreme convenience of clipboard synchronization, and the use of the clipboard by most password managers, it is unrealistic to expect such facilities to be universally disabled. The security provided by OnlyKey is potentially compromised the moment a password hits the clipboard.
Resolution
Embed a password generator into the OnlyKey App that doesn't transit the password outside of the OnlyKey-App process. No clipboard, no network - dramatically reduced attack surface.
The generator uses the node.js crypto module's random number generator - which is supposed to be cryptographically secure (unlike math.random). Specifically, it uses crypto.randomInt to avoid modulus biasing.
The user can select from various character classes, specify a length, character exclusions, and review / edit the password before applying it to the slot editor fields (or canceling).
Screenshots
Slot editor with the "Gen" button next to the password field.
Courtesy of @JasonJShuler
Added a cryptographically strong random password generator dialog to the slot editor, launched via a button next to the password field.
Rationale
The clipboard is a dangerous place for high-security passwords, especially when using remote desktops and virtual machines. Clipboard contents are readily available in cleartext to all local processes - even without admin rights. Furthermore, the clipboard is often synchronized with remote desktop clients and virtual machines - Linux, Windows and Android-based.
Windows 10 and 11 and some Android versions provide clipboard history and cross-device synchronizing... sometimes by default. The security around this clipboard history is dubious and ill-defined.
Considering the extreme convenience of clipboard synchronization, and the use of the clipboard by most password managers, it is unrealistic to expect such facilities to be universally disabled. The security provided by OnlyKey is potentially compromised the moment a password hits the clipboard.
Resolution
Embed a password generator into the OnlyKey App that doesn't transit the password outside of the OnlyKey-App process. No clipboard, no network - dramatically reduced attack surface.
The generator uses the node.js crypto module's random number generator - which is supposed to be cryptographically secure (unlike math.random). Specifically, it uses crypto.randomInt to avoid modulus biasing.
The user can select from various character classes, specify a length, character exclusions, and review / edit the password before applying it to the slot editor fields (or canceling).
Screenshots
Slot editor with the "Gen" button next to the password field.
Generator Dialog