passwordsafe-devel — For developers of Password Safe

Re: [Passwordsafe-devel] Thoughts on TOTP/HOTP support in PasswordSafe?

[Bill B. <de...@bl...>]

On Fri, Oct 04, 2019 at 08:13:07AM +0300, pwsafe.org wrote:
> A few thoughts:
> 
> - This will require format changes - at least one new field to indicate the
> entry is for a OTP, and not a "regular" password.

I was just looking through the format docs for V3 and V4, and they both
list "Two-Factor Key" as a (yet to be implemented) field type (0x1b).
Is it safe to assume we could use this?  Though we would still need
additional fields for OTP parameters (e.g., hash algorithm, length of the
generated code, etc.)

Since applications are supposed to be able to handle unknown fields in a
forward-compatible way, it seems like there shouldn't be an issue with
adding new fields to the existing formats (as opposed to waiting and
adding it to the next format).  Is this correct?


> - Are the specs for the various authenticators out there (Authy, Google
> Authenticator, etc.) publicly available and usable to implement a clone in
> pwsafe?

Yes, the HOTP spec is RFC4226 [1] and the TOTP spec is RFC6238 [2].
While I wouldn't be surprised if certain vendors had "peculiarities"
with their implementation, I'd expect the vast majority of differences
to be handled by changing the OTP parameters.

> - The biggest challenge for implementing this is to do so in a way that
> won't "penalize" the users of "classic" passwords. By "penalize" I mean
> require extra clicks/keystrokes over what's required today to create and
> use a given entry.

I'm open to other ideas, but my initial thought for the UI is

  - The entry's view/edit dialog would get an additional tab for
    OTP-related configuration.  On this tab, the user could enter their
    seed/key and configure their parameters.

    Since I expect that the average user doesn't want to have to know/care
    about which hash algorithm to choose and similar things, I think we
    could create some "presets" for common configurations, and give them
    user-friendly names/descriptions.  Then also have a way for advanced
    users to manually set the parameters if needed.

  - The entry's right-click menu would get two additional items:

      - Display Authenticator Code - opens a dialog that shows the code and
        time remaining indicator (similar to how "Display Password as QR
        Code" opens a dialog today).  This basically presents the same
        interface as most authenticator apps.  There could optionally be
        a button here to copy the code to the clipboard.

      - Copy Authenticator Code to Clipboard - copies the code to the
        clipboard.


If implemented as I described above, then the user might have to move
past two additional items in the right-click menu.  But I don't think
there would be any additional clicks to create/use an entry unless the
user decided to use OTP for that entry.


Bill



[1] https://tools.ietf.org/html/rfc4226
[2] https://tools.ietf.org/html/rfc6238



-- 
GPG: 5CDD 0C9C F446 BC1B 2509  8791 1762 E022 7034 CF84

Re: [Passwordsafe-devel] [Passwordsafe-linux] Thoughts on TOTP/HOTP support in PasswordSafe?

[Mark M. <mar...@gm...>]

Hi there,

I've done a bit of work on this for my app (Strongbox) which supports
KeePass and Password Safe.

In the KeePass windows world people used plugins to manage this feature. It
has proven to be popular and has been made native in KeePassXC (A cross
platform KeePass client) and also in my own app.

I'd be happy to help with any queries you have. Currently if a user adds a
TOTP via my app to their Password Safe database I support this by appending
an OTPAUTH url to their notes field (less than ideal but functional).

To answer one of the questions raised above:

- Are the specs for the various authenticators out there (Authy, Google
Authenticator, etc.) publicly available and usable to implement a clone in
pwsafe?
Yes (the standard is RFC 6238)

Other things to think about off the top of my head for anyone looking to
implement this:

- Parameters are often required (Hash Algorithm (usually SHA1), Number of
Digits (usually 6), Period (usually 30 seconds))
- OTPAUTH urls could be supported, they combine the parameters, the seed
and some metadata like the Issuer, Name, Username and look like:

otpauth://totp/
ACME%20Co:joh...@em...?secret=HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ&issuer=ACME%20Co&algorithm=SHA1&digits=8&period=31

They are usually scanned from a QR Code.

- Some people use a variant of the standard RFC 6238 algo for use with
"Steam" tokens, a gaming provider.

FWIW, this is handled in the KeePass world by using "Custom Fields",
basically a feature that allows for a set of Key-Value Pairs. I don't
believe the equivalent exists in the Password Safe world and you might not
want to go that route anyway, but in short a TOTP configuration can be
added to any entry alongside a regular password.

Hope that's helpful.

Best,
-Mark

On Fri, 4 Oct 2019 at 09:07, pwsafe.org <ro...@pw...> wrote:

> Hi Tom,
>
> I think that Bill meant adding one time password support for
> different sites, not for authenticating PasswordSafe itself using TOTP/HOTP.
>
> Yubikey is currently supported, including the ability to configure a
> backup device as you described.
>
> Rony
>
> On Fri, Oct 4, 2019 at 7:38 AM Tom Mitchell <mi...@ni...> wrote:
>
>> On Thu, Oct 3, 2019 at 8:55 PM Bill Blough via Passwordsafe-linux
>> <pas...@li...> wrote:
>> >
>> > Hi all,
>> >
>> > I've been considering implementing TOTP/HOTP support in PasswordSafe.
>>
>> It seems possible and interesting but I would rather add YubiKey  support
>> first.
>> One weakness with password managers is key management for the password
>> manger
>> software itself.  Two YubiKey device support please.   A pair of
>> YubiKey  devices allows a second device to be
>> kept in a sealed tamper evident envelop of the managers or company
>> office safe. The encrypted password-safe file
>> can be replicated as needed for portability.
>>
>> One problem with the Google and Microsoft Authentication  is they are
>> tied to devices that
>> are easy to misplace and also have fragile to strong unlock features.
>> They are useful.
>>
>>
>>
>> --
>>           T o m    M i t c h e l l ( o n   N i f t y E g g )
>>
>>
>> _______________________________________________
>> Passwordsafe-linux mailing list
>> Pas...@li...
>> https://lists.sourceforge.net/lists/listinfo/passwordsafe-linux
>>
>
>
> --
> Ubi dubium, ibi libertas (where there is doubt, there is freedom)
> _______________________________________________
> Passwordsafe-devel mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>

Re: [Passwordsafe-devel] [Passwordsafe-linux] Thoughts on TOTP/HOTP support in PasswordSafe?

[pwsafe.org <ro...@pw...>]

Hi Tom,

I think that Bill meant adding one time password support for
different sites, not for authenticating PasswordSafe itself using TOTP/HOTP.

Yubikey is currently supported, including the ability to configure a backup
device as you described.

Rony

On Fri, Oct 4, 2019 at 7:38 AM Tom Mitchell <mi...@ni...> wrote:

> On Thu, Oct 3, 2019 at 8:55 PM Bill Blough via Passwordsafe-linux
> <pas...@li...> wrote:
> >
> > Hi all,
> >
> > I've been considering implementing TOTP/HOTP support in PasswordSafe.
>
> It seems possible and interesting but I would rather add YubiKey  support
> first.
> One weakness with password managers is key management for the password
> manger
> software itself.  Two YubiKey device support please.   A pair of
> YubiKey  devices allows a second device to be
> kept in a sealed tamper evident envelop of the managers or company
> office safe. The encrypted password-safe file
> can be replicated as needed for portability.
>
> One problem with the Google and Microsoft Authentication  is they are
> tied to devices that
> are easy to misplace and also have fragile to strong unlock features.
> They are useful.
>
>
>
> --
>           T o m    M i t c h e l l ( o n   N i f t y E g g )
>
>
> _______________________________________________
> Passwordsafe-linux mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-linux
>


-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)

Re: [Passwordsafe-devel] Thoughts on TOTP/HOTP support in PasswordSafe?

[pwsafe.org <ro...@pw...>]

A few thoughts:

- This will require format changes - at least one new field to indicate the
entry is for a OTP, and not a "regular" password.
- Are the specs for the various authenticators out there (Authy, Google
Authenticator, etc.) publicly available and usable to implement a clone in
pwsafe?
- The biggest challenge for implementing this is to do so in a way that
won't "penalize" the users of "classic" passwords. By "penalize" I mean
require extra clicks/keystrokes over what's required today to create and
use a given entry.

Discussion?

On Fri, Oct 4, 2019 at 6:18 AM Bill Blough via Passwordsafe-devel <
pas...@li...> wrote:

> Hi all,
>
> I've been considering implementing TOTP/HOTP support in PasswordSafe.
> The idea is that you would be able to store the seed for a given
> account, then have PasswordSafe generate the TOTP/HOTP code as needed
> (instead of using something like Google Authenticator).
>
> However, I've had some people (unrelated to this project) suggest that
> this is a Bad Idea^TM.  Since I'm writing this email, it's probably obvious
> that I disagree.  I'd be happy to explain my rationale if anyone wants to
> discuss it.
>
> I do think it would be convenient functionality to have for those of use
> that would use it, and I'm willing to do the work.  Well, at least for
> core and wx.  I could probably do the Windows implementation too, but I
> haven't done Windows GUI programming in something like 20 years. As
> such, if someone else wanted to handle that piece, I'd be grateful.
>
> That said, I don't want to spend the time and effort needed to implement
> it only to find out that everyone thinks I'm completely bonkers and that
> it will never get merged.
>
> So is this something I should pursue, or should I skip it?
>
> Regards,
> Bill
>
> --
> GPG: 5CDD 0C9C F446 BC1B 2509  8791 1762 E022 7034 CF84
>
>
> _______________________________________________
> Passwordsafe-devel mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>


-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)

Re: [Passwordsafe-devel] [Passwordsafe-linux] Thoughts on TOTP/HOTP support in PasswordSafe?

[Tom M. <mi...@ni...>]

On Thu, Oct 3, 2019 at 8:55 PM Bill Blough via Passwordsafe-linux
<pas...@li...> wrote:
>
> Hi all,
>
> I've been considering implementing TOTP/HOTP support in PasswordSafe.

It seems possible and interesting but I would rather add YubiKey  support first.
One weakness with password managers is key management for the password manger
software itself.  Two YubiKey device support please.   A pair of
YubiKey  devices allows a second device to be
kept in a sealed tamper evident envelop of the managers or company
office safe. The encrypted password-safe file
can be replicated as needed for portability.

One problem with the Google and Microsoft Authentication  is they are
tied to devices that
are easy to misplace and also have fragile to strong unlock features.
They are useful.



-- 
          T o m    M i t c h e l l ( o n   N i f t y E g g )

[Passwordsafe-devel] Thoughts on TOTP/HOTP support in PasswordSafe?

[Bill B. <de...@bl...>]

Hi all,

I've been considering implementing TOTP/HOTP support in PasswordSafe.
The idea is that you would be able to store the seed for a given
account, then have PasswordSafe generate the TOTP/HOTP code as needed
(instead of using something like Google Authenticator).

However, I've had some people (unrelated to this project) suggest that
this is a Bad Idea^TM.  Since I'm writing this email, it's probably obvious
that I disagree.  I'd be happy to explain my rationale if anyone wants to
discuss it.

I do think it would be convenient functionality to have for those of use
that would use it, and I'm willing to do the work.  Well, at least for
core and wx.  I could probably do the Windows implementation too, but I
haven't done Windows GUI programming in something like 20 years. As
such, if someone else wanted to handle that piece, I'd be grateful.

That said, I don't want to spend the time and effort needed to implement
it only to find out that everyone thinks I'm completely bonkers and that
it will never get merged.

So is this something I should pursue, or should I skip it?

Regards,
Bill

-- 
GPG: 5CDD 0C9C F446 BC1B 2509  8791 1762 E022 7034 CF84

[Passwordsafe-devel] PasswordSafe 3.50 pre-release

[pwsafe.org <ro...@pw...>]

Hi,
I'd like to release PasswordSafe 3.
50
 in
a couple of weeks
. As usual, I've setup a pre-elease for testing and translators in
https://sourceforge.net/projects/passwordsafe/files/PreReleases/3.50.0pre3/

The 'pos' directory in the above link has the texts to be translated in the
.po files.

Translators are invited to mail me the updated po files for inclusion in
the next
release (or create pull requests on GitHub
<https://github.com/pwsafe/pwsafe>).

"pre-release" means that there may be more bugfixes until the formal
release, but no user-visible changes (texts in particular
should
 remain unchanged).

Thanks,

  Rony



-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)

Re: [Passwordsafe-devel] [Passwordsafe-linux] PasswordSafe's Windows UI frameworks

[Bill B. <de...@bl...>]

On Sat, Jul 06, 2019 at 01:17:55PM +0300, pwsafe.org wrote:
> So now I'm considering three options:
> 1. Local fix: Move from CPWToolBar::CToolBar to CPWToolBar::CMFCToolBar
> 2. Switch to the wxWidgets UI for Windows as the shipping UI.
> 3. Switch to the Qt UI framework, which appears to be much more polished
> than wxWidgets, for Windows, and perhaps for Linux as well. The Qt Open
> Source License is GPL 2/3, but I think that this is compatible with the
> project's license (that is, I think a mixed license would work).
> 

I think consolidating to one cross-platform UI makes sense from an
implementation/maintenance standpoint.

I expect that the quickest way forward would be #2 (switch the Windows
version to use wx).

Then if it's decided that QT is a better choice, that migration could
happen in the future for all platforms at the same time.


Just my 2c.

Bill





> _______________________________________________
> Passwordsafe-linux mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-linux


-- 
GPG: 5CDD 0C9C F446 BC1B 2509  8791 1762 E022 7034 CF84

Re: [Passwordsafe-devel] [Passwordsafe-linux] PasswordSafe's Windows UI frameworks

[Bill W. <wo...@ne...>]

My vote would be to spend that time improving the Linux version.

I also use the Java version on my Macs and the Android version.

Thanks very much for maintaining this incredibly useful program!

pwsafe.org <ro...@pw...> wrote:

> Hi,
> 
> I'm at a crossroad with regards to the Windows version of PasswordSafe, and would
> like to get input from the members of this list.
> 
> PasswordSafe's Windows UI is built directly upon MFC from the first releases. This
> means that over time, we've enhanced MFC's functionality by deriving classes from
> MFC with functionality "borrowed" from other sources.
> 
> Case in point: CPWToolbar is derived from the CToolBar MFC class, with code added to
> support the PasswordSafe graphics. Problem is, new display technology is poorly
> supported by CPWToolBar::CToolBar.
> 
> Micorsoft has replaced CToolBar with CMFCToolBar, which contains much of the new
> functionality that was previously hand-coded in CPWToolBar. The switch to
> CPWToolBar::CMFCToolBar, however, is non-trivial.
> 
> Also, the PasswordSafe Windows UI is getting a bit old, compared to today's
> programs, and could use a general facelift.
> 
> So now I'm considering three options:
> 1. Local fix: Move from CPWToolBar::CToolBar to CPWToolBar::CMFCToolBar
> 2. Switch to the wxWidgets UI for Windows as the shipping UI.
> 3. Switch to the Qt UI framework, which appears to be much more polished than
> wxWidgets, for Windows, and perhaps for Linux as well. The Qt Open Source License is
> GPL 2/3, but I think that this is compatible with the project's license (that is, I
> think a mixed license would work).
> 
> Thoughts, anyone?
> 
> Rony
> 
> 
> ----------------------------------------------------
> Alternatives:
> 
> ----------------------------------------------------
> _______________________________________________
> Passwordsafe-linux mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-linux

-- 
Bill Wohler <wo...@ne...> aka <Bil...@na...>
http://www.newt.com/wohler/, GnuPG ID:610BD9AD

[Passwordsafe-devel] PasswordSafe's Windows UI frameworks

[pwsafe.org <ro...@pw...>]

Hi,

I'm at a crossroad with regards to the Windows version of PasswordSafe, and
would like to get input from the members of this list.

PasswordSafe's Windows UI is built directly upon MFC from the first
releases. This means that over time, we've enhanced MFC's functionality by
deriving classes from MFC with functionality "borrowed" from other sources.

Case in point: CPWToolbar is derived from the CToolBar MFC class, with code
added to support the PasswordSafe graphics. Problem is, new display
technology is poorly supported by CPWToolBar::CToolBar.

Micorsoft has replaced CToolBar with CMFCToolBar, which contains much of
the new functionality that was previously hand-coded in CPWToolBar. The
switch to CPWToolBar::CMFCToolBar, however, is non-trivial.

Also, the PasswordSafe Windows UI is getting a bit old, compared to today's
programs, and could use a general facelift.

So now I'm considering three options:
1. Local fix: Move from CPWToolBar::CToolBar to CPWToolBar::CMFCToolBar
2. Switch to the wxWidgets UI for Windows as the shipping UI.
3. Switch to the Qt UI framework, which appears to be much more polished
than wxWidgets, for Windows, and perhaps for Linux as well. The Qt Open
Source License is GPL 2/3, but I think that this is compatible with the
project's license (that is, I think a mixed license would work).

Thoughts, anyone?

Rony

[Passwordsafe-devel] Announcing PasswordSafe 3.49.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi,

This is to announce the release of PasswordSafe version 3.49.0 for Windows.
The main addition to this release is a new executable. pwsafe-cli.exe, that
supports actions on PasswordSafe files from the command line. This is
useful for scripting, e.g., via powershell.
Thanks to Akos, Andrey, Isakov, RafaelX,  and SauravG for their help in this
release.
Thanks also to all the users who have provided bug reports, suggestions,
and the occasional donation...



The PasswordSafe2Go version will be updated soon and available from
http://www.shareit.com/product.html?cart=1&productid=300597408&stylefrom=300597408
(Owners of previous releases are invited to contact me for an update)

The Windows release may be downloaded from
https://sourceforge.net/projects/passwordsafe/files/ (Newest Files):

SHA-1 checksums:
55b36fe5235b7916b8a94bc0e2c9322494875be9 *pwsafe-3.49.0.exe
31af4b03c6cc8c05830cbcbfafd5b454f83c2dbc *pwsafe-3.49.0.msi
249aa2254a5e8a1f312d277107f99368dcb0709c *pwsafe64-3.49.0.exe
73f336df7780fe370b8c5ddd7ea93739f1191c2a *pwsafe64-3.49.0.msi
ce8f54300dc1aa5cfe7ea50199783a5e69988aa1 *pwsafe-3.49.0-bin.zip
1131600d5728cef17a8bc4c5fa8a359869fc5953 *pwsafe64-3.49.0-bin.zip
0f1c9a897d901498501d04d8a8b5dfbe547ebfd5 *pwsafe-3.49.0-src.zip

The Linux versions should be ready in a few days, and will be announced on
the passwordsafe-linux mailing list.

Enjoy,

  Rony

[Passwordsafe-devel] PasswordSafe Linux Beta release 1.07

[pwsafe.org <ro...@pw...>]

Hi,

PasswordSafe Linux 1.07 Beta is formally released.

Packages for Debian, Ubuntu and Fedora may be downloaded from
https://github.com/pwsafe/pwsafe/releases/tag/1.07BETA
or
https://sourceforge.net/projects/passwordsafe/files/Linux-BETA/1.07BETA/

Let me know if you need a build for another distro, and I'll see what I can
do.

Thanks to Rafael, Sauravg, pm_kan, and dskrvk for their contributions, and
to all who submitted bug reports, suggestions and the occasional donation.

Happy 2019 to all.

Rony

[Passwordsafe-devel] Announcing PasswordSafe 3.48.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi,

This is to announce the release of PasswordSafe version 3.48.0 for Windows.
This is a maintenance release, fixing a few minor issues, as described
below.
Thanks to dshrvk, pm-kan, rafaelx and sauravg for their help in this
release.
Thanks also to all the users who have provided bug reports, suggestions,
and the occasional donation...

New Features in 3.48.0
======================
[] Default expiration interval is now configurable via Options->Password
History, instead of being hardcoded to 90 days.

Bugs Fixed in 3.48.0
====================
[1481] Export subgroups correctly.
[1480] Fixed typo in English dragbar tooltip texts.
[1475] Tweak RNG initialization.
[1473] Installer will not create startup shortcut by default when upgrading.
[1243] Installer now selects language support for selected installer
language.


The PasswordSafe2Go version will be updated soon and available from
http://www.shareit.com/product.html?cart=1&productid=300597408&stylefrom=300597408
(Owners of previous releases are invited to contact me for an update)

The Windows release may be downloaded from
https://sourceforge.net/projects/passwordsafe/files/ or
https://github.com/pwsafe/pwsafe/releases
(Newest Files):

https://github.com/pwsafe/pwsafe/releases/download/3.48.0/pwsafe-3.48.0.exe
(installer)
https://github.com/pwsafe/pwsafe/releases/download/3.48.0/pwsafe64-3.48.0.exe
(64bit installer)

https://github.com/pwsafe/pwsafe/releases/download/3.48.0/pwsafe-3.48.0-bin.zip
(zip file with binaries, for those who don't like installers)
https://github.com/pwsafe/pwsafe/releases/download/3.48.0/pwsafe64-3.48.0-bin.zip
(64
bit zip file with binaries, for those who don't like installers)

https://github.com/pwsafe/pwsafe/releases/download/3.48.0/pwsafe-3.48.0.msi
(Microsoft
installer)
https://github.com/pwsafe/pwsafe/releases/download/3.48.0/pwsafe64-3.48.0.msi
(64 bit Microsoft installer)

https://github.com/pwsafe/pwsafe/archive/3.48.0.zip (source code)

SHA-1 checksums:
de1fc86482b59c1850d575d425afae15e3966ae1 *pwsafe-3.48.0.exe
9e368d786b6d7085203e4df344b8663b5fe5a8a8 *pwsafe-3.48.0.msi
f53efde1c9d3837956d8cea780184b15e1f3980e *pwsafe64-3.48.0.exe
f3a26ceff2aa7390464d312c76ef9d1ca3b268b1 *pwsafe64-3.48.0.msi
25dd84ee4d9473661daf4b88494da8deb8f598e6 *pwsafe-3.48.0-bin.zip
5fa5c602c9afb5d93e474855d78f3c274c45b6de *pwsafe64-3.48.0-bin.zip
91b4833388e090356e5b7d42111273ec690a04f9 *pwsafe-3.48.0-src.zip

The Linux versions should be ready in a few days, and will be announced on
the passwordsafe-linux mailing list.

Enjoy,

  Rony

-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)

[Passwordsafe-devel] pwsafe-pre-release

[pwsafe.org <ro...@pw...>]

Hi,
I'd like to release PasswordSafe 3.
48 around mid-December
. As usual, I've setup a pre-elease for testing and translators in
https://sourceforge.net/projects/passwordsafe/files/PreReleases/3.48pre/

The 'pos' directory in the above link has the texts to be translated in the
.po files.

Translators are invited to mail me the updated po files for inclusion in
the next
release (or create pull requests on GitHub
<https://github.com/pwsafe/pwsafe>).

"pre-release" means that there may be more bugfixes until the formal
release, but no user-visible changes (texts in particular
should
 remain unchanged).

Thanks,

  Rony

P.S. - I will be travelling from tomorrow until December 9th, with limited
internet access, so my apologies in advance for late response.

Re: [Passwordsafe-devel] File Attachment Feature in V3 Format

[Mark M. <mar...@gm...>]

Ok thanks Rony, I'll hopefully get to work on this shortly.

Cheers,
-Mark

On Sat, 6 Oct 2018 at 16:49, pwsafe.org <ro...@pw...> wrote:

> Hi Mark,
>
> An argument could be made that an evolutionary approach such you propose
> is best.
>
> Even if you don't reuse the V4 core code, you might be able to use (and
> improve?) the classes used to manage and display attachments.
>
> If you care to submit a pull request on the Github repo, I'll start a
> separate "V3Att" branch so that others can review / contribute before
> merging into master and releasing this to the public.
>
> Thanks,
>
>   Rony
>
> On Sun, Sep 30, 2018 at 4:41 PM Mark McGuill <mar...@gm...>
> wrote:
>
>> Hi,
>>
>> I've just been chatting with Rony over email about adding a feature to
>> the V3 format to allow people to store files (e.g. images, etc) as part of
>> a record. He suggested it was best to mail this list with the idea, and see
>> what your thoughts are here.
>>
>> I maintain the Strongbox iOS and Mac app (https://strongboxsafe.com),
>> which are Password Safe clients. I get frequent feature requests from
>> people to allow them to add images or attachments to their safes. This is a
>> feature I'd like myself for my own safes too, I'm sure some of you feel the
>> same.
>>
>> Rony had some concerns about performance, which I think are worth
>> discussing. Also, I know that as part of V4 there is some expected support
>> for file attachments. I think however that getting this feature in V3 would
>> be a big win for all password safe users, and I think it could be done in a
>> way that would satisfy a lot of users.
>>
>> As regards the performance given large file sizes, I think that clients
>> could help protect against this by imposing a file size limit (perhaps
>> 5-10MB), and explaining the consequences of adding many large files to the
>> users. I've tested very large databases on iOS devices, and had pretty good
>> results, but of course your mileage will vary, given the device and client
>> implementations.
>>
>> Rony mentioned that it might be worth trying to back port the V4 work
>> that had been done on this feature, into V3. I haven't had a chance to take
>> a look at the feasibility of this just yet, it seems like a full
>> service/Rolls Royce solution that would deal with the performance issues of
>> large databases very well.
>>
>> Separately, I had my own idea of how to do this, that while not as robust
>> and performant as Rony's model, would require very little design changes,
>> and I think could be a fairly straightforward implementation for other
>> clients/platforms.
>>
>> The idea is simply to create a new Record Field Type and some kind of
>> (pseudo code) data structure like so:
>>
>> typedef struct _FileAttachment {
>>
>>     char fileNameLength[4];   // 4 hexadecimal digit file name length
>> (in TCHAR) - Password History Style Length
>>
>>     char mimeTypeLength[4];   // 4 hexadecimal digit mime type length
>> (in TCHAR) - Password History Style Length
>>
>>     char filename[...];       // The file name
>>
>>     char mimeType[...];       // a mime type such as 'image/jpeg' - to
>> aid with opening / encoding / display etc
>>
>>     unsigned char data[];     // The actual data of the file filled out
>> to the end of the field
>>
>> } FileAttachment;
>>
>>
>> I hope that makes sense. Would love to hear your thoughts. I think this
>> could be a great feature for the Password Safe format.
>>
>> Thanks and all the best,
>> -Mark
>> _______________________________________________
>> Passwordsafe-devel mailing list
>> Pas...@li...
>> https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>>
>
>
> --
> Ubi dubium, ibi libertas (where there is doubt, there is freedom)
>

Re: [Passwordsafe-devel] File Attachment Feature in V3 Format

[pwsafe.org <ro...@pw...>]

Hi Mark,

An argument could be made that an evolutionary approach such you propose is
best.

Even if you don't reuse the V4 core code, you might be able to use (and
improve?) the classes used to manage and display attachments.

If you care to submit a pull request on the Github repo, I'll start a
separate "V3Att" branch so that others can review / contribute before
merging into master and releasing this to the public.

Thanks,

  Rony

On Sun, Sep 30, 2018 at 4:41 PM Mark McGuill <mar...@gm...> wrote:

> Hi,
>
> I've just been chatting with Rony over email about adding a feature to the
> V3 format to allow people to store files (e.g. images, etc) as part of a
> record. He suggested it was best to mail this list with the idea, and see
> what your thoughts are here.
>
> I maintain the Strongbox iOS and Mac app (https://strongboxsafe.com),
> which are Password Safe clients. I get frequent feature requests from
> people to allow them to add images or attachments to their safes. This is a
> feature I'd like myself for my own safes too, I'm sure some of you feel the
> same.
>
> Rony had some concerns about performance, which I think are worth
> discussing. Also, I know that as part of V4 there is some expected support
> for file attachments. I think however that getting this feature in V3 would
> be a big win for all password safe users, and I think it could be done in a
> way that would satisfy a lot of users.
>
> As regards the performance given large file sizes, I think that clients
> could help protect against this by imposing a file size limit (perhaps
> 5-10MB), and explaining the consequences of adding many large files to the
> users. I've tested very large databases on iOS devices, and had pretty good
> results, but of course your mileage will vary, given the device and client
> implementations.
>
> Rony mentioned that it might be worth trying to back port the V4 work that
> had been done on this feature, into V3. I haven't had a chance to take a
> look at the feasibility of this just yet, it seems like a full
> service/Rolls Royce solution that would deal with the performance issues of
> large databases very well.
>
> Separately, I had my own idea of how to do this, that while not as robust
> and performant as Rony's model, would require very little design changes,
> and I think could be a fairly straightforward implementation for other
> clients/platforms.
>
> The idea is simply to create a new Record Field Type and some kind of
> (pseudo code) data structure like so:
>
> typedef struct _FileAttachment {
>
>     char fileNameLength[4];   // 4 hexadecimal digit file name length (in
> TCHAR) - Password History Style Length
>
>     char mimeTypeLength[4];   // 4 hexadecimal digit mime type length (in
> TCHAR) - Password History Style Length
>
>     char filename[...];       // The file name
>
>     char mimeType[...];       // a mime type such as 'image/jpeg' - to
> aid with opening / encoding / display etc
>
>     unsigned char data[];     // The actual data of the file filled out
> to the end of the field
>
> } FileAttachment;
>
>
> I hope that makes sense. Would love to hear your thoughts. I think this
> could be a great feature for the Password Safe format.
>
> Thanks and all the best,
> -Mark
> _______________________________________________
> Passwordsafe-devel mailing list
> Pas...@li...
> https://lists.sourceforge.net/lists/listinfo/passwordsafe-devel
>


-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)

[Passwordsafe-devel] File Attachment Feature in V3 Format

[Mark M. <mar...@gm...>]

Hi,

I've just been chatting with Rony over email about adding a feature to the
V3 format to allow people to store files (e.g. images, etc) as part of a
record. He suggested it was best to mail this list with the idea, and see
what your thoughts are here.

I maintain the Strongbox iOS and Mac app (https://strongboxsafe.com), which
are Password Safe clients. I get frequent feature requests from people to
allow them to add images or attachments to their safes. This is a feature
I'd like myself for my own safes too, I'm sure some of you feel the same.

Rony had some concerns about performance, which I think are worth
discussing. Also, I know that as part of V4 there is some expected support
for file attachments. I think however that getting this feature in V3 would
be a big win for all password safe users, and I think it could be done in a
way that would satisfy a lot of users.

As regards the performance given large file sizes, I think that clients
could help protect against this by imposing a file size limit (perhaps
5-10MB), and explaining the consequences of adding many large files to the
users. I've tested very large databases on iOS devices, and had pretty good
results, but of course your mileage will vary, given the device and client
implementations.

Rony mentioned that it might be worth trying to back port the V4 work that
had been done on this feature, into V3. I haven't had a chance to take a
look at the feasibility of this just yet, it seems like a full
service/Rolls Royce solution that would deal with the performance issues of
large databases very well.

Separately, I had my own idea of how to do this, that while not as robust
and performant as Rony's model, would require very little design changes,
and I think could be a fairly straightforward implementation for other
clients/platforms.

The idea is simply to create a new Record Field Type and some kind of
(pseudo code) data structure like so:

typedef struct _FileAttachment {

    char fileNameLength[4];   // 4 hexadecimal digit file name length (in
TCHAR) - Password History Style Length

    char mimeTypeLength[4];   // 4 hexadecimal digit mime type length (in
TCHAR) - Password History Style Length

    char filename[...];       // The file name

    char mimeType[...];       // a mime type such as 'image/jpeg' - to aid
with opening / encoding / display etc

    unsigned char data[];     // The actual data of the file filled out to
the end of the field

} FileAttachment;


I hope that makes sense. Would love to hear your thoughts. I think this
could be a great feature for the Password Safe format.

Thanks and all the best,
-Mark

[Passwordsafe-devel] Announcing PasswordSafe 3.47.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi,

This is to announce the release of PasswordSafe version 3.47.0 for Windows.
This is a maintenance release, fixing a few minor issues, as described
below.
Thanks to bblough, dskrvk, pm_kan and rafaelx  for their help in this
release.
Thanks also to all the users who have provided bug reports, suggestions,
and the occasional donation...

New Features in 3.47.0
======================
[862] Last time the master password was changed is kept and displayed in
File->Properties.

Bugs Fixed in 3.47.0
====================
[] Clipboard is more secure - cleared 3 seconds after copied data is first
pasted.
[1465] Removed possibility of not setting Yubikey in changed passphrase by
mistake.
[1453] Fixed regression in tooltip display introduced in fix of BR1449
[1448] Less confusing behavior when the current safe can't be found upon
restore.


The PasswordSafe2Go version will be updated soon and available from
http://www.shareit.com/product.html?cart=1&productid=300597408&stylefrom=300597408
(Owners of previous releases are invited to contact me for an update)

The Windows release may be downloaded from
https://sourceforge.net/projects/passwordsafe/files/ (Newest Files):

https://github.com/pwsafe/pwsafe/releases/tag/3.47.0
or
https://sourceforge.net/projects/passwordsafe/files/Windows/3.47.0/

https://github.com/pwsafe/pwsafe/releases/download/3.47.0/pwsafe-3.47.0.exe
 (installer)
https://github.com/pwsafe/pwsafe/releases/download/3.47.0/pwsafe64-3.47.0.exe
(64
bit installer)

https://github.com/pwsafe/pwsafe/releases/download/3.47.0/pwsafe-3.47.0-bin.zip
(zip
file with binaries, for those who don't like installers)
https://github.com/pwsafe/pwsafe/releases/download/3.47.0/pwsafe64-3.47.0-bin.zip
(64
bit version)

https://github.com/pwsafe/pwsafe/releases/download/3.47.0/pwsafe-3.47.0.msi
(Microsoft
installer)
https://github.com/pwsafe/pwsafe/releases/download/3.47.0/pwsafe64-3.47.0.msi
(64
bit version)

https://github.com/pwsafe/pwsafe/archive/3.47.0.zip (source code)



SHA-1 checksums:
2154b39f4ed3f39bcae90d5f7ab8db3e0d0333f3 *pwsafe-3.47.0.exe
5eb0734295355c69866862d7af19d0fadcf1514f *pwsafe-3.47.0.msi
358740d9f884bed3f93dcf33ecc515e91d1c65fc *pwsafe64-3.47.0.exe
bfd3f34e669a24ad2a801e2e62bfbefff00aafc2 *pwsafe64-3.47.0.msi
a14b4ae6df14f5d057e9cbe531f70f6b3dd70542 *pwsafe-3.47.0-bin.zip
7706cd5aff6383fcf4f722ee8e499fe0633ecbac *pwsafe64-3.47.0-bin.zip
9d7b4cd91d855d9037bea3d6b1562f2b9ab7e9f9 *pwsafe-3.47.0-src.zip


The Linux versions should be ready in a few days, and will be announced on
the passwordsafe-linux mailing list.

Enjoy,

  Rony


-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)


-- 
Ubi dubium, ibi libertas (where there is doubt, there is freedom)

[Passwordsafe-devel] pwsafe 3.47 pre-release

[pwsafe.org <ro...@pw...>]

Hi,
I'd like to release PasswordSafe 3.
47
 in
a couple of weeks
. As usual, I've setup a pre-elease for testing and translators in
https://sourceforge.net/projects/passwordsafe/files/PreReleases/3.47pre/

The 'pos' directory in the above link has the texts to be translated in the
.po files.

Translators are invited to mail me the updated po files for inclusion in
the next
release (or create pull requests on GitHub
<https://github.com/pwsafe/pwsafe>).

"pre-release" means that there may be more bugfixes until the formal
release, but no user-visible changes (texts in particular
should
 remain unchanged).

Thanks,

  Rony

[Passwordsafe-devel] Announcing PasswordSafe 3.46.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi,

This is to announce the release of PasswordSafe version 3.46.0 for Windows.
This is a maintenance release, fixing a few minor issues, as described
below.
Thanks to bblough, dskrvk, pm_kan and rafaelx for their help in this
release.
Thanks also to all the users who have provided bug reports, suggestions,
and the occasional donation...


Bugs Fixed in 3.46.0
====================
[1458] Fixed compatability issue between Unix and Windows versions
when master password had non-ASCII characters.
[1457] Protect Entry / Group now works when language isn't English.
[1456] Shortcut entries no longer use default username if base entry's
username is empty.
[1455] Ctrl+Enter shortcut now works correctly in read-only mode.
[1454, G411] No longer thinks security preference has changed when it
hasn't.


The PasswordSafe2Go version will be updated soon and available from
http://www.shareit.com/product.html?cart=1&productid=
300597408&stylefrom=300597408
(Owners of previous releases are invited to contact me for an update)

The Windows release may be downloaded from

https://github.com/pwsafe/pwsafe/releases/tag/3.46.0
or
https://sourceforge.net/projects/passwordsafe/files/passwordsafe/3.46.0/

https://github.com/pwsafe/pwsafe/releases/download/3.46.0/pwsafe-3.46.0.exe
 (installer)
https://github.com/pwsafe/pwsafe/releases/download/3.46.0/pwsafe64-3.46.0.exe
(64
bit installer)

https://github.com/pwsafe/pwsafe/releases/download/3.46.0/pwsafe-3.46.0-bin.zip
(zip
file with binaries, for those who don't like installers)
https://github.com/pwsafe/pwsafe/releases/download/3.46.0/pwsafe64-3.46.0-bin.zip
(64
bit version)

https://github.com/pwsafe/pwsafe/releases/download/3.46.0/pwsafe-3.46.0.msi
(Microsoft
installer)
https://github.com/pwsafe/pwsafe/releases/download/3.46.0/pwsafe64-3.46.0.msi
(64
bit version)

https://github.com/pwsafe/pwsafe/archive/3.46.0.zip (source code)


SHA-1 checksums:
6caa94e1b83016e29bc6cacf8954d9f681218817 *pwsafe-3.46.0.exe
7aeb17937eab8ec6c1e47902079dcfdcf4a89153 *pwsafe-3.46.0.msi
09a7dd349600ee002630100e2a872cde516d3dbf *pwsafe64-3.46.0.exe
0f2baa4644e844996047e36b53c984b3d864dfed *pwsafe64-3.46.0.msi
bc28c4976ed72486d73917e5fd45a98fd65a5d03 *pwsafe-3.46.0-bin.zip
b282ae8701c7850f2d377af9b6451a6c49de67a0 *pwsafe64-3.46.0-bin.zip
0f74c7ce49da605ac51712bd4e664de8b28c9955 *pwsafe-3.46.0-src.zip


The Linux versions should be ready in a few days, and will be announced on
the passwordsafe-linux mailing list.

Enjoy,

  Rony

[Passwordsafe-devel] PasswordSafe 3.​46 pre-release

[pwsafe.org <ro...@pw...>]

Hi,
I'd like to release PasswordSafe 3.
​46
 in
​a couple of weeks
. As usual, I've setup a pre-release for testing and translators in
​ ​https://sourceforge.net/projects/passwordsafe/files/PreReleases/3.46pre/

The 'pos' directory in the above link has the texts to be translated in the
.po files.

Translators are invited to mail me the updated po files for inclusion in
the next
​ ​
release (or create pull requests on GitHub
<https://github.com/pwsafe/pwsafe>).

"pre-release" means that there may be more bugfixes until the formal
release, but no user-visible changes (texts in particular
​should​
 remain unchanged).

Thanks,

  Rony

Re: [Passwordsafe-devel] Announcing PasswordSafe 3.45.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi again,

I inadvertently hit "Send" before filling in the list of contributors to
this release:

I'd like to thank Bert, bblough, dskrvk, grin, Honore Doktorr, pm-kan,
rafaelx, SeeK-ntr0py, and sp1l for contributing code and translations to
version 3.45.0.

Cheers,

  Rony

[Passwordsafe-devel] Announcing PasswordSafe 3.45.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi,

This is to announce the release of PasswordSafe version 3.45.0 for Windows.
This is a maintenance release, fixing a few minor issues, as described
below.
Thanks to  for their help in this release.
Thanks also to all the users who have provided bug reports, suggestions,
and the occasional donation...


Bugs Fixed in 3.45.0
====================
[G360] (a) System tray icon starts out brown, not green.
(b) Remove system tray icon when cancelling password entry.
[G357] Russian installation text displays correctly.
[1450] Can now generate passwords longer than 94 characters.
[1449] Cleanup statusbar tooltip text.
[1445] Fixed crash on autotype with malformed text.
[1444] Fixed crash in display of Password Policies in Czech.
[1442] Fixed regression: -s flag (silent opening) works again.
[1441] Changing unlock difficulty now enables save (regression), supported
under undo/redo.
[1192] Don't revert to original r-o when locking with an edit box open.


The PasswordSafe2Go version will be updated soon and available from
http://www.shareit.com/product.html?cart=1&productid=
300597408&stylefrom=300597408
(Owners of previous releases are invited to contact me for an update)

The Windows release may be downloaded from

https://github.com/pwsafe/pwsafe/releases/tag/3.45.0
or
https://sourceforge.net/projects/passwordsafe/files/passwordsafe/3.45.0/

https://github.com/pwsafe/pwsafe/releases/download/3.45.0/pwsafe-3.45.0.exe
 (installer)
https://github.com/pwsafe/pwsafe/releases/download/3.45.0/pwsafe64-3.45.0.exe
(64
bit installer)

https://github.com/pwsafe/pwsafe/releases/download/3.45.0/pwsafe-3.45.0-bin.zip
(zip
file with binaries, for those who don't like installers)
https://github.com/pwsafe/pwsafe/releases/download/3.45.0/pwsafe64-3.45.0-bin.zip
(64
bit version)

https://github.com/pwsafe/pwsafe/releases/download/3.45.0/pwsafe-3.45.0.msi
(Microsoft
installer)
https://github.com/pwsafe/pwsafe/releases/download/3.45.0/pwsafe64-3.45.0.msi
(64
bit version)

https://github.com/pwsafe/pwsafe/archive/3.45.0.zip (source code)


SHA-1 checksums:
40cfda3ebc3f608627f4cd3e41cf627d0eb0b7b9 *pwsafe-3.45.0.exe
7c2065082c0025b3927c8f2babce91180109c311 *pwsafe-3.45.0.msi
f361ba7daecb4a6dbe92e0198516e6a4224c6ec5 *pwsafe64-3.45.0.exe
592a519cf36edd4062c3cda961e07fee2d09d5de *pwsafe64-3.45.0.msi
826c55b345623bc48aaa45d6842bb76e2945d171 *pwsafe-3.45.0-bin.zip
db7192e3c3bfdb7594c42b6e98ecc23e715fd8b8 *pwsafe64-3.45.0-bin.zip
02424bfa33703b1649919daca3ef19b9148c74e5 *pwsafe-3.45.0-src.zip

The Linux versions should be ready in a few days, and will be announced on
the passwordsafe-linux mailing list.

Enjoy,

  Rony

[Passwordsafe-devel] pwsafe-pre-release

[pwsafe.org <ro...@pw...>]

Hi,
I'd like to release PasswordSafe 3.
​45
 in
​a couple of weeks
. As usual, I've setup a pre-elease for testing and translators in
​ ​https://sourceforge.net/projects/passwordsafe/files/PreReleases/3.45pre/

The 'pos' directory in the above link has the texts to be translated in the
.po files.

Translators are invited to mail me the updated po files for inclusion in
the next
​ ​
release (or create pull requests on GitHub
<https://github.com/pwsafe/pwsafe>).

"pre-release" means that there may be more bugfixes until the formal
release, but no user-visible changes (texts in particular
​should​
 remain unchanged).

Thanks,

  Rony

[Passwordsafe-devel] Announcing PasswordSafe 3.44.0 for Windows

[pwsafe.org <ro...@pw...>]

Hi,

This is to announce the release of PasswordSafe version 3.44.0 for Windows.
This is a maintenance release, fixing a few minor issues, adding some small
features, as described below.
Thanks to dk, pm_kan, SauravG, Larry, MrMe for their help in this release.
Thanks also to all the users who have provided bug reports, suggestions,
and the occasional donation...

Bugs Fixed in 3.44.0
====================
[1438] Double backslash is now correctly parsed in Run Command.
[1432] Perform autotype of correct entry when the user changes the
selection made by a Find.
[1431] The protected entry padlock symbol is now used in all places
where a protected
entry is listed in any dialog.
[1430] If an expired or about to be expired entry is edited at database
open (requires warning preference to be enabled), the database will be
saved if the 'Save database immediately after any change' preference is
enabled. After the open is complete, these changes can be undone/redone if
required.
[1429] Tree and List views now retain focus when a shortcut entry is
created.
[1428] Remember Find toolbar state when restoring from minimized.
[1420] The virtual keyboard font size setting is now persistent.
[1398] Remember if PasswordSafe was maximized when exited.

Changes to Existing Features in 3.44.0
======================================
[] The option that allows you to change the color of the system tray
icon displayed
when Password Safe is initially started and when there's no open database has
been removed. The standard PasswordSafe brown icon will be used.
[] Use the Add/Edit font in preference to the Tree/List font outside the
actual Tree/List views (since the Tree/List fonts may be too large).

New Features for 3.44.0
=======================
[] When exporting a group or the results of a filter, if any additional
entries have been exported (e.g. base entries of aliases or shortcuts
already exported), they will be noted in the Export report.
[844] The default font for the password field is now 12pt Consolas.
[843] The default font for Tree/List views, Add/Edit fields and an entry's
Notes is now 10pt Segoe UI.
[842] A new symbol (paperclip - Unicode U+01F4CE) to indicate that an entry
has an attachment (V4 databases only) has been implemented but, if the
currently selected Tree/List font does not support it and the user is not
running Windows 10, then the old symbol ('+') will be used.
[841] Close/exit is now allowed via System Tray icon when the database is
open in read-only mode.
[839] The list of expired entries now shows protected entries in italics,
indicating that they must be unprotected before they can be updated.
[828] The main window can now be set to be partially transparent via
Manage->Options->Display.


The PasswordSafe2Go version will be updated soon and available from
http://www.shareit.com/product.html?cart=1&productid=
300597408&stylefrom=300597408
(Owners of previous releases are invited to contact me for an update)

The Windows release may be downloaded from

https://github.com/pwsafe/pwsafe/releases/tag/3.44.0
or
https://sourceforge.net/projects/passwordsafe/files/passwordsafe/3.44.0/

https://github.com/pwsafe/pwsafe/releases/download/3.44.0/pwsafe-3.44.0.exe
 (installer)
https://github.com/pwsafe/pwsafe/releases/download/3.44.0/pwsafe64-3.44.0.exe
(64
bit installer)

https://github.com/pwsafe/pwsafe/releases/download/3.44.0/pwsafe-3.44.0-bin.zip
(zip
file with binaries, for those who don't like installers)
https://github.com/pwsafe/pwsafe/releases/download/3.44.0/pwsafe64-3.44.0-bin.zip
(64
bit version)

https://github.com/pwsafe/pwsafe/releases/download/3.44.0/pwsafe-3.44.0.msi
(Microsoft
installer)
https://github.com/pwsafe/pwsafe/releases/download/3.44.0/pwsafe64-3.44.0.msi
(64
bit version)

https://github.com/pwsafe/pwsafe/archive/3.44.0.zip (source code)

SHA-1 checksums:
8e7d59ae5218ff7e727c19933a7a78b3030d5c45 *pwsafe-3.44.0.exe
655536877fd2295dc13391211ddcb947e9f5e56b *pwsafe-3.44.0.msi
8295f3124ece100894972c8bac333ab9fb52371a *pwsafe64-3.44.0.exe
488f8ac4c424c66279769d97095264b318214bb0 *pwsafe64-3.44.0.msi
c036bce357539c7d3284ac3f778df50c7d3fd50d *pwsafe-3.44.0-bin.zip
8207da69d589c8412065e151d40d0800a81bb460 *pwsafe64-3.44.0-bin.zip

The Linux versions should be ready in a few days, and will be announced on
the passwordsafe-linux mailing list.

Enjoy,

  Rony