Yubico Forum

Re: [PROJECT] Yubinotes - Notes app for Android

2013-10-17T20:26:06+01:00

foxzilla wrote:

Anyone else unable to edit notes? I can create them just fine but when reopened, there's no way to edit them (Sony Xperia V).

Same here. It is essential that a user be able to open and edit a note, as well as copy text in the note, as I would like to use the app to store passwords for non-yubikey enabled apps.

Is the dev still around?

Statistics: Posted by smalis — Thu Oct 17, 2013 8:26 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-07-03T18:34:33+01:00

Anyone else unable to edit notes? I can create them just fine but when reopened, there's no way to edit them (Sony Xperia V).

Statistics: Posted by foxzilla — Wed Jul 03, 2013 6:34 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-06-21T19:01:38+01:00

Untouchab1e wrote:

Dont get me started on how I feel about Android AV though >_<

That's a shame I am genuinely interested to know. I always assumed there was little point in Android AV, like in Linux, but wasn't entirely sure - is it all smoke and mirrors and do I not need it?

Statistics: Posted by kingqueen — Fri Jun 21, 2013 7:01 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-06-20T16:09:32+01:00

kingqueen wrote:

Thank you ever so for your work on this.

For some reason, Avast thinks that your app is malware. You and I know it isn't, so I've reported a "false positive" to Avast.

Pressing the "Info" button is uninformative.

Thanks for the interesting find!

I wonder what the basis for the false positive here could be. The crypto stuff perhaps? At any rate, thanks for reporting it as a false positive.

Dont get me started on how I feel about Android AV though >_<

Statistics: Posted by Untouchab1e — Thu Jun 20, 2013 4:09 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-06-20T16:08:17+01:00

Morphlin wrote:

Hi,

I tried your app, pretty cool. I like the design

I have no idea how difficult this would be but do you think you could sync the notes with google tasks? Of course they would be unreadable on gmail but at least if your phone is lost, your notes can be recovered without loss.

Also, the progressbar that shows when its going to lock is REALLY awesome. Its buggy on my phone but the concept is perfect.

Keep up the good work!

Alex

Thanks for the positive feedback. Ive been a bit busy recently and havent had much time to improve the app, but hopefully Ill find time to get some work done on it soon.

Statistics: Posted by Untouchab1e — Thu Jun 20, 2013 4:08 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-06-18T16:56:04+01:00

Statistics: Posted by kingqueen — Tue Jun 18, 2013 4:56 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-06-12T05:34:28+01:00

Statistics: Posted by Morphlin — Wed Jun 12, 2013 5:34 am

Re: [PROJECT] Yubinotes - Notes app for Android

2013-05-04T17:11:45+01:00

foxzilla wrote:

(just so there isn't a huge wall of text, I'm separating this to another post)

I see you already updated the timer lock to wait for user input - thanks!

My suggestions for improvement:
- some way to open the memos if the Yubikey is lost
- the "back" button closes the program, rather than goes back - I'm slowly starting to remember this, but still often close the app when I only want to get back to the main menu
- the timer lock doesn't start the countdown after unlocking, but rather after navigating further into memos - this poses the possibility that the database will be left open, especially if it is only opened to change settings
- if I'm on the "All Notes" view with timer lock enabled and timed out ("waiting for user") and the screen times out (=goes off), then once screen is turned on the database has been locked but the app is still open in the "All Notes" view. The notes are shown in encrypted form but can be edited, thus risking destroying them.
- when the timer lock has timed out, using the apps own back button results in closing the app
- if the timer lock times out while in the settings menu, the app closes

Great collection of feedback! I will figure out a way to sort it all out! Thanks a lot.

A quick note though, the "back" button does close the program (which is not intended, but kinda happened that way), but you can hit the left most button in the action bar instead to go back.

But again, great observations and I appreciate the feedback.

Statistics: Posted by Untouchab1e — Sat May 04, 2013 5:11 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-05-04T17:08:53+01:00

Quote:

I can see this being a problem. If the app is ever going to be used to store something at least slightly important, there must be a way to restore the contents in case the Yubikey is lost/destroyed/not working. At least with the current implementation of the static ID, there could be a way to enter it manually and unlock that way (provided the user has written the ID down for safekeeping earlier). Don't know what the backup could be with other modes though..

I agree, and I am working on figuring out a way to backup the notes. Maybe by exporting them to file and encrypting it with a password? However, think of the lock as one you would find on a door. If you loose your key, you cant unlock the door. But yes, I even know someone who had a YubiKey Neo suddenly go faulty, so this needs to be dealt with somehow. Thanks!

Quote:

Good point, especially so since the NEO can't use slot 2 with NFC. So could possible modes be:
- mode 1: Yubikey static ID, like it is now
- mode 2 Yubico OTP (has to be online, slower to authenticate)
- mode 3 Challenge-Response (has to have a dedicated NEO)

Does this make sense? Some other option to combine practicability and security?

Yep, this makes sense and I am actively working on it

Quote:

When you say guessed, do you mean the lenght of the ID which is quite short (=easier to bruteforce)

Its just that the device id's seem to follow a certain pattern, but I dont know for sure.

Quote:

How do the random device keys work/protect the memos? As far as I understand, the user or the attacker only has to provide the Yubikey ID and the database will open?

Think of it like a door with three locks. Your YubiKey is one key, the two randomly and uniquely generated device keys are the two other keys. You need all three to be able to decrypt the notes. This kinda gives you two factor authentication in that you need both your phone and your YubiKey/Password. If someone was to somehow extract the YubiNotes sqlite database, they would have a pretty hard time decrypting the keys, even if the attacker had your YubiKey as well.

Quote:

Please bear with me with the crypto questions, I'm a complete noob when it comes to those..

No worries, happy to help shed some light on the matter

Statistics: Posted by Untouchab1e — Sat May 04, 2013 5:08 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-05-04T17:02:57+01:00

Statistics: Posted by foxzilla — Sat May 04, 2013 5:02 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-05-04T16:55:29+01:00

Quote:

- Odd that the time lock doesnt start if you switched password/yubikey mode. The time lock feature should be completely separated. I will have to try and see if I can reproduce the problem.

This actually started working again later. Don't know what the hiccup was..

Quote:

- By design, its not possible to use two different yubikeys to decrypt the same notes due to the nature of how the encryption key system works.

Quote:

+ Its practical because you dont need to program one of your Yubikey slots in a specific manner to make it work with YubiNotes.

Quote:

- The Device ID is unique but can be guessed. This is partially mitigated for by the fact that the device id is only one part of the encryption key system. (The other parts use the uniquely generated random device keys).

When you say guessed, do you mean the lenght of the ID which is quite short (=easier to bruteforce)?

How do the random device keys work/protect the memos? As far as I understand, the user or the attacker only has to provide the Yubikey ID and the database will open?

Please bear with me with the crypto questions, I'm a complete noob when it comes to those..

Statistics: Posted by foxzilla — Sat May 04, 2013 4:55 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-05-03T21:24:30+01:00

foxzilla wrote:

Just found the app on Google Play. LOVE it! Once it's more fully featured (see below), this'll be replacing my current notes app for sure.

Does the app utilize the actual OTP of the NEO or just the ID? Since it's not using challenge-response and is not online, I'm guessing the latter?

Things I noticed after testing for a few minutes (you probably already have these on your todos, but I'll post them anyway for now..):
- Unticking the "Yubikey Mode" and thus destroying all your notes is way too easy (edit: looks like changing back to Yubikey mode made the notes readable again. Still..)
- Timer lock locks the notes even if the app is being used
- After initially choosing Yubikey Mode, I changed to password mode and then back again: now the timer lock won't activate at all anymore
- Way to use two NEO's with the app in case one is lost

Hi!

Thanks so much for the feedback! Its this kind of input I need to get things working well!

- Unticking the YubiKey mode does not destroy your notes. If you check the box again you can use your Yubikey to decrypt the notes again. The notes are not deleted. EDIT: I see now you realized the same thing. But yes, I see your point though and I will give it some thought to figure out a better way to do this.

- Its true that the Timer locks the notes even if the app is being used. I guess its not ideal and I will see if I can make it more user-aware

- Odd that the time lock doesnt start if you switched password/yubikey mode. The time lock feature should be completely separated. I will have to try and see if I can reproduce the problem.

- By design, its not possible to use two different yubikeys to decrypt the same notes due to the nature of how the encryption key system works.

And yes, you are correct in that currently, its the Yubikey device ID thats being used for encryption/decryption. This has one advantage and one disadvantage (which is partially mitigated for).

+ Its practical because you dont need to program one of your Yubikey slots in a specific manner to make it work with YubiNotes.
- The Device ID is unique but can be guessed. This is partially mitigated for by the fact that the device id is only one part of the encryption key system. (The other parts use the uniquely generated random device keys).

Hope this answered your questions! Again, thanks for your input! Most valuable!

Statistics: Posted by Untouchab1e — Fri May 03, 2013 9:24 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-05-03T19:36:33+01:00

Statistics: Posted by foxzilla — Fri May 03, 2013 7:36 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-04-22T14:36:42+01:00

First beta out on the Play Store now

Statistics: Posted by Untouchab1e — Mon Apr 22, 2013 2:36 pm

Re: [PROJECT] Yubinotes - Notes app for Android

2013-04-15T21:37:01+01:00

fti wrote:

How does it work?
I thought HMAC-SHA1 is just for Authentication purposes, not for Encryption/Decryption?!

Or is it "cloud" based, which checks the Authentication and returns the correct AES Decryption Key?

Best Regards,
Frank

Hi there!

Right now, the plan is to have three "modes". Regular password protection, for those without a yubikey, a offline yubikey mode which is based on the device id, and an online yubikey mode which would be "cloud" based.

Now, the device id is not the most secure approach. It can be guessed. However, only someone with physical access to the device and your yubikey (or your guessed yubikey ID) will be able to access your notes as both the yubikey and the random generated encryption code which is generated the first time you run the app is used along with the yubkey to encrypt and decrypt the notes.

That said, nothing is set in stone and I am constantly switching things around.

A more detailed description of how the app works is available here.

I am currently Beta testing the app and making sure most kinks and issues are ironed out before publishing it to the Play Store

Statistics: Posted by Untouchab1e — Mon Apr 15, 2013 9:37 pm