Password Vault

Problem

Many users rely on insecure methods to create and store their passwords. My goal was to build a secure, user friendly password manager that:

• Provides strong client-side encryption
• Enables users to create, store, retrieve and manage their credentials across all of their devices
• Demonstrates security focussed development practises for prospective employers

The project was inspired by a similar tool I originally built using Python with Tkinter which can be found in the Github Documentation

Solution

Password vault is a full stack application designed to securely manage and store user credentials. The developed system follows the principles of the CIA triad:

• Confidentiality - All sensitive data is obfuscated and transmissions of data use secure protocols to prevent disclosure. Suitable authorisation and authentication protocols are in place to maintain the privacy of users.
• Integrity - Access logs and hashing are implemented to prevent the alteration of data.
• Availability - Data is maintained using servers that use effective security solutions to prevent denial of access to users or destruction of their data.

Architecture

Security Considerations

In this project I designed a system in which users data is entered in the frontend, before being transmitted to the backend for storage in a database. The main security concerns were:

• Frontend must be configured in a way that minimises the risk of data loss to techniques such as cross site scripting (XSS)
• Users unobfuscated data must not remain in memory on the users device
• All data transferred between the frontend and backend must be done so via secure transmission protocols to minimise the risk of a successful man in the middle (MITM) or downgrade attack
• All data stored at the backend must be in a secure form, so that in the event of a data breach the user data involved will be unusable
• Encrypted data must not be stored in the same location as its corresponding encryption key
• Data should not be exposed in a plaintext form on the backend where it might be vulnerable to an insider threat

My solution was to use a system where passwords are encrypted on the frontend before transfer to the backend

• 1. User enters master password at frontend
• 2. Encryption key derived from master password and salt
• 3. User enters password at frontend
• 4. Password is encrypted using encryption key
• 5. Cipher text and salt sent to backend
• 6. To view password, backend sends cipher text to frontend
• 7. User enters master password at frontend, which with the salt is used to derive encryption key
• 8. Password is decrypted using encryption key

A full breakdown of the projects security considerations can be found in the Github Documentation

Key Challenges

• Security - Required careful design of encryption/decryption logic to ensure zero-knowledge expectation was fulfilled and to minimise impact in event of security breach
• Email verification - Original email service was AWS SES but encountered repeatedly refused requests to exit sandbox mode. To solve this Resend was implemented in the project
• Mobile app limitations - React Native implementation was scrapped due to compatibility issues with Expo and required Node.js libraries
• Legal considerations - Release of the project to production could have lead to liability issues if there were a breach. Due to lack of funding for penetration testing the decision was made for the application to be released as a demonstration only. Fail safes have been implemented such as a waiver at the frontend and periodic data wipes at the backend
• Designing authentication flow - Special consideration was given to the implementation and handling of authentication tokens. Short lived session tokens along with device based authentication minimise the risks of token interception.

What I Learned

This project allowed me to gain understanding in building full-stack applications using Python backends and JavaScript frontends. It also provided opportunity to get hands on experience with practises and techniques learnt while studying for the Security+, Casp+, CySA+ and Pentest+ certifications.

This was my first time developing a Django based backend and allowed me to develop further understanding of the practical application of Python with deployment in mind.

The security heavy nature of the application lead me to think more about liability based concerns in a project, and the steps that must be taken by developers to mitigate these.