mooltipass | Github repository dedicated to the mooltipass project | Identity Management library

Is your solution better than a piece of paper? A piece of paper contains passwords that can easily be read when you are not paying attention to it. The Mooltipass stores encrypted passwords that can only be read when providing your PIN code. If I only need to remember a PIN code, does it mean the Mooltipass is not safe? Not at all, as the Mooltipass system is exactly like your chip and pin card: 3 false tries will permanently block the smart card and make credential decryption impossible. Why do I need different passwords for different websites? Websites are compromised on a daily basis. If you are using the same password for different websites, one attacker could use a password he discovered on all of them. Why do you need an OLED screen? An offline password keeper needs to provide a way to prevent impersonation. The user has to check that the website/service he’s approving the credential sending for is the same that the website/service he’s currently visiting/using, as a malicious program could emit forged requests. Moreover, having a display allows the user to operate the Mooltipass without the browser plugin using our dedicated touch interface. Why are you using both a smart card and a main Mooltipass device? There are many reasons, the main one being that it is much easier to carry a smart card around than any other object. This smart card is a secure element that contains your credentials' encryption key, it is cheap and may be cloned without compromising the system security. What if I lose my smartcard? Our device is shipped with two smartcards, so you can keep your copy somewhere safe. The Mooltipass therefore allows the user to clone his smartcard as many times as he wants, provided that the card PIN is correctly entered. Can the smartcard be used with multiple Mooltipass? You can synchronize your credentials between multiple devices. This allows you to have one Mooltipass at work and one at home. What if I lose my Mooltipass device? Your encrypted credentials can be exported to either your computer or the Mooltipass official website. If you lose your device, you may purchase another one and restore your credentials. Are you sure about your encryption implementation? The AES-256 used in the Mooltipass has been compared again standard Nessie test vectors for correctness. Moreover, our security chain has been checked by qualified individuals. Can I use it on Windows/Linux/Mac? Yes, as no drivers are required to use the Mooltipass. It is recognized as a standard USB keyboard that will enter passwords for you. Can I use on my computer/laptop/phone/tablet…​? Most (if not all) devices (including smart phones and tablet PCs) include a USB host capable port. The Mooltipass will work with all of them. How secure is the Mooltipass? We are using the most secure encryption algorithms and designed our case to make physical tampering practically impossible. Our solution is therefore perfectly suited for individuals wanting to improve their credentials safety. Are you planning to make a wireless version? The Mooltipass isn’t wireless to skip the added costs of a lithium-ion battery and a wireless interface. Customer survey also let us know that having a USB cable wasn’t a problem for most use cases. How are the credentials sent to the computer? The Mooltipass is enumerated as a composite HID keyboard / HID proprietary device. The credentials are sent over the HID proprietary channel when using the browser plugin and over the keyboard channel when using the Mooltipass through its touch interface. Is it still possible to sniff the passwords sent over HID? In theory yes. As mentioned in our project description the Mooltipass aims at reducing the number of attack vectors to a minimum: the device basically types your password as if you were doing it yourself. Perfect security could only be achieved by sharing dedicated secrets with every possible service and website…​ which is practically impossible to do. If I can export my encrypted credentials, does this mean someone could crack them? In short, no. We are using AES-256 encryption in CTR mode, bruteforcing the encrypted credentials takes more than fifty years. If it is open source, does it mean it is less secure? Not at all. Having our code open source allows everyone to check our security implementation, which actually leads to a better code quality and more trust from our final users.