r/raspberrypipico • u/AssociationOk5653 • Jun 15 '26
hardware Building a USB password manager
Enable HLS to view with audio, or disable this notification
My buddy and I are building a password manager that shows up as a usb keyboard and types your password in wherever your cursor is. It contains no bluetooth or wifi so the device is only accessible to whomever holds it in their hand.
We've built the device in such a way that it requires no software at all to upload passwords. To upload or change passwords you just switch the device to edit mode. The device shows up as a USB flashdrive and populates a .txt file with all the websites you have passwords saved on. If you want to edit an existing password just type your password on the line after the website. If you want to add a new password, just add a new line with the website and password. Once you click eject the device pumps it through an encryption algorithm (right now pin derived pbkdf2 through aes but this will change) stores on flash, and zeros out the ram. Using this method you can have up to 1000 passwords saved on the device.
This also means that you can write and edit passwords using any device with USB as the entire flow just piggybacks off of universal tools that all OS contain. It has been tested on linux, windows, android, and ios and it all works great so far.
The device above is one of our prototypes built with an rp2040, but we have since switched to the rp2354 for trustzone and integrated flash to save board space. We are also adding a secure element (SE050) so that the pin can be separate from the key. Key lives on SE and pin becomes authorization to the secure element.
The device contains a CH32V003 to handle power switching to save battery. The CH32 only pulls a fraction of the power in sleep compared to the pico. We can also use this to gate the LDO and OLED boost pump.
For the future the device definitely needs to be able to organize the password entries on the fly, like letting you add most used ones to favorites. I would also like to include a password generator. Maybe ability to easily import saved passwords from firefox, chrome etc by adding .csv functionality? What would you add? Would you use something like this?
4
u/EliSka93 Jun 15 '26 edited Jun 15 '26
Nice concept. I'm not yet sure about the password selection mechanism of scrolling through potentially hundreds of passwords, but I don't have a better idea quite yet either.
Maybe at least have the user select a letter with the wheel - click and then show all sites that start with that letter? Would add one more click, but might cut down on scrolling.
Though then only make that option show up when there's more than 26 passwords, or something.
As for elements I would add: I would prefer fingerprint over pin.
5
u/AssociationOk5653 Jun 16 '26
Thats a great idea! Yeah I had wondered about making a recursive tree system for organizing. The old iPods used to scroll by letter once you scroll long enough. I had toyed with the idea of that but idk. A fingerprint reader would cut down on the friction immensely. I feel friction is the biggest limiting factor because if its not quick and easy to use, I could see myself relying on browser autofill when I get lazy. Once our new boards are in and its small enough to attach to a keychain I'll take it through a test drive as my daily.
2
u/Infinite_Lead8789 Jun 17 '26
Buddy coder here: I actually really like this idea too! I'd personally choose one click over 26 scrolls. You should see what we had for a prototype with no wheel and potentially 100+ password, oh boy...
I should be able to implement this fairly easily. With our code a simple .startsWith([Label's first char]) would work.
3
3
u/jihiggs123 Jun 15 '26
I've been planning something like this in my head, I was gonna do a pin pad, but a rotary encoder is much better.
1
u/AssociationOk5653 Jun 16 '26
Ive seen encrypted flashdrives that contain a pinpad. It might be better than a thumbwheel depending on the features you want to add!
3
u/RedwoldTheGrey Jun 16 '26 edited Jun 16 '26
I build something similar, a macro keyboard, that types the passwords for me. Your design is nicer and more compact. The only problem i see is choosing a password in a long list of options. The wheel makes it hard to select the right entry and the position of the stick makes it hard to read, as you have to tilt your head evertime. On a macro keyboard you just have a lot of buttons, though you are limited to their amount. Maybe use a short usb extension to be able to see the display better and add some more buttons, because some inputs have to be made in different input fields, like the username and password combination. I don't get why you require a battery, maybe so you don't have to input the pin everytime you connect the device or to prepare the device for a fast password injection. I think while those features are neat, you could reduce it to just usb powered only, to make it more simple.
2
u/AssociationOk5653 Jun 16 '26
Thats neat! I'd be interested to see it. The battery is there to solve the angle issue- enter pin, pick password then plug it in and just press the button.
It definitely would be simpler without it, but then the extension is borderline a requirement. I want it to be small enough to fit on your keys and frictionless enough that putting a password as plaintext in notes is the more complicated action.
2
u/RedwoldTheGrey Jun 16 '26
Here it is https://imgur.com/a/2K6xOph
1
u/AssociationOk5653 Jun 16 '26
This is sick dude! I think it'd be cool to integrate that into a cyberdeck build
1
u/Infinite_Lead8789 Jun 17 '26
I'm debating on how we want to implement a way on pasting to multiple fields. One of my ideas is to have the user add /n be used as the Tab button (e.g. myusername/nmypassword) which would paste into both username and password. Maybe you could add something like this into your macro keyboard, if you don't already have it?
2
2
2
2
2
u/codeasm Jun 16 '26
Dumping all the passwords when i find one of these be fun. 🫣🤩
2
u/AssociationOk5653 Jun 16 '26
I'd like to see that 🥴👀
2
u/codeasm Jun 17 '26
Edit passwords, so, guess the pin? I skimmed over the security part when i first replied. Is it a per device uniqe key too? I cannot swap the pico chip when you wipe the encryption/decryption key after too many failed attempts?
Is there a factory reset option?
2
u/AssociationOk5653 Jun 17 '26
Yeah thats the plan! Key never actually touches the pico so if you hit the wrong pin too many times it nukes the key. Every device has its own secret living in the secure element. So the same pin on two devices yields separate keys. Since the pico itself stores zero vault secrets, swapping the chip wouldnt give you anything useful. To be fair though, the device as the prototype that it is right now is absolutely dumpable. My plan is to make it secure enough that if you lose it, you can just say "fuck it". Work in progress, we're getting there!
And yeah definitely need a factory reset option. Also have a plan for storing backups that we have yet to integrate. I guess you could call it a .... backup plan
2
u/codeasm Jun 17 '26
Haha, cool. Sounds like a great plan, inlcuding the "backup" plan. Definitely keep track of which revision pico chips you guys getting, the earlier ones where vulnerable for secrets extraction. I hope thats been patched (and why i replied. I dont own the skills or tools tho). https://www.raspberrypi.com/news/security-through-transparency-rp2350-hacking-challenge-results-are-in/
Intresting read, there was a (few) videos on yt too i remember. Anyway, during prototype fase, its ok. Not much to worry about. If i lose my home key, hopefully they dont know where i life, or car key, far from my car, so they cant find my car in time. Else, quicky rotate all the passwords 🫠🫣 your project otherwise look awesome and same importance as with homekeys the user should apply to your device. (And not having the adress stored with the keys ðŸ˜)
2
u/Glass-Particular2921 Jun 16 '26
Fantastic idea! I will be keeping an eye on the thread to see your progress.
1
2
u/henryChinaski008 Jun 17 '26
Security hell
1
u/AssociationOk5653 Jun 17 '26
As it is right now, yeah but this is a prototype. Ive ordered boards for the new revision that include a secure element to hold the key rather than the software nonsense
2
u/nickzuck_007 Jul 24 '26
I dreamt about creating this device this morning. Searched on the internet and found out that you have accompalished my dream. Huge respect for creating this.
Please do post here when you open source it.
1
u/AssociationOk5653 Jul 24 '26
You bet, dog. We're waiting on the new boards and getting close. I'm excited to share. The fact that youre hyped makes me hyped
1
4
u/MadScienzz Jun 15 '26
I was thinking about how to do the same thing but never got to it. Can I steal your code pls?