diff options
Diffstat (limited to 'content/en/hardenedpass/reference/security')
| -rw-r--r-- | content/en/hardenedpass/reference/security/index.md | 59 |
1 files changed, 55 insertions, 4 deletions
diff --git a/content/en/hardenedpass/reference/security/index.md b/content/en/hardenedpass/reference/security/index.md index 0c1ba30..c865c1d 100644 --- a/content/en/hardenedpass/reference/security/index.md +++ b/content/en/hardenedpass/reference/security/index.md @@ -1,13 +1,64 @@ +++ title = "Security" date = 2026-11-05T00:00:00Z -description = "" +description = "What HardenedPass protects, where each secret lives, what it sends over the network and which threats it does not cover." weight = 100 draft = true +++ -Placeholder. +This page says what the app does for you and, just as important, what it does not do. -## First heading +## Where your secrets live + +| Secret | Where it is | How it is protected | +|---|---|---| +| Entries | Files in the app's private storage, and on your git server | OpenPGP, the same as `pass` on a computer | +| OpenPGP private key | The app's private storage | Its own passphrase | +| Key passphrase | Nowhere, unless you enable caching | If cached: AES-GCM under an Android Keystore key | +| Git and proxy passwords | The app's private storage, if you tell it to remember them | AES-GCM under an Android Keystore key | +| SSH key made on the phone | Android Keystore | The system, plus your screen lock if you ask for it | +| SSH key you imported | The app's private storage | Its own passphrase, if it has one | + +Android Keystore keys are held by the system and cannot be copied out of the phone, even +by the app that uses them. + +## What the app does + +- **No telemetry.** No analytics, no crash reports, no Google Play Services. The app + only connects to the git server you configured, and to your proxy if you set one. +- **Blocks screenshots of secrets.** Entries, the editor, the generator, passphrase + dialogs and autofill windows cannot be captured by screenshots, and do not appear in + the recent apps view. +- **Clears the clipboard.** A copied password is removed after a timeout. +- **Checks the SSH server.** The server's host key is saved on first connection and + checked after that. The first connection is trusted without asking, so make it on a + network you trust. +- **Trusts known browsers only.** Autofill works only in browsers whose signing + certificate the app recognizes, and warns you if an app's publisher changes. See + [Autofill]({{< relref "/hardenedpass/using/autofill" >}}). +- **Refuses outside files.** Other apps can open the app, but it only opens paths that + really are inside your store. + +## What the app does not protect you from + +- **A compromised phone.** Malware that controls an unlocked phone can see what you + see. Keep the system up to date. +- **Your keyboard.** A keyboard app sees everything you type, the passphrase included. + Use one you trust, with network access off if your system allows that. +- **Other apps reading the clipboard** before the timeout runs out. Autofill avoids the + clipboard altogether. +- **A weak passphrase.** If someone gets your key file, the passphrase is all that is + left. +- **Your git server seeing names.** Entry and folder names are file names, and they are + not encrypted, so the server can read them, along with the dates of your commits. +- **Biometric lock as encryption.** **Enable biometric authentication** is a gate at app + start. It keeps out someone holding your unlocked phone for a moment, and it does not + encrypt anything. +- **Losing your key.** No one can recover a store without its private key and passphrase. + +## Passphrase caching + +Caching is convenient, but while the passphrase is cached, anyone who gets into the +unlocked app can open every entry. It is experimental. If you use it, turn on +**Automatically clear passphrase cache** as well. -Text. |