pi2pwd

USING THE PI ZERO AS A PASSWORD MANAGER

If you want a proper password manager, see this project. If you want something that does the job and is quite possibly the simplest Pi Zero project ever, keep reading!

ASSISTIVE TECHNOLOGY

I decided it was time for me to implement password best practices and use different strong passwords for all sites I log into. Since the old brain has deteriorated recently, I needed some kind of password management. An online solution didn't seem very secure. I use several different computers, so installing software wasn't an option. A flash drive with the passwords on it would probably work, but I don't like putting passwords in the paste buffer. Yes, I'm that paranoid. So, I needed to build a password manager: something that would emulate a keyboard and type out stored passwords on command. I decided to use the Pi Zero for this since I had already done something similar.

KEEPING IT SIMPLE

I always try to make my projects as simple as possible: partly to lower cost, but mostly because I hate wiring stuff up. I get super paranoid that I've wired something wrong and the magic smoke is going to escape. And it gets worse as more wires are involved. Simplifying this one, though, stumped me. The breakthrough came when I decided navigation between entry fields would be done manually (with the mouse) to handle the differences in login forms. This let me break the remainder of the problem into simple steps that applied to all the systems I wanted to log into:

Since the manager would have several passwords, I would need some method to select one. This meant some kind of output (to display which system the password was for), and some kind of input. The amount of buttons necessary for input could be minimized by displaying each system name in turn with a pause between each. Then I'd only need one button to select, and this same button could to tell the manager to type the username and then the password. So I'd need a one line display and one button.

After thinking some more I realized the system cursor is already on a username field, where everything you type is displayed. It's exactly like a one line display! Send keystrokes to type things, backspaces to erase. This could be the display for system names: display one for a second or two, backspace it out, display the next one, etc. A seperate display wasn't needed at all. Yay! So now I needed no display and one button.

Then I remembered something you may not know: the keyboard lock lights aren't controlled by the keyboard keys directly. If you push/release a lock key, the keyboard sends the corresponging lock key down/up code, but doesn't change the corresponging lock light. It's up to the attached system to send a command to the keyboard to turn the proper light on or off . (This is also why the lights can become mixed up: a light command was missed by the keyboard.) Furthermore, if multiple keyboards are attached and you press a lock key, the lock lights are updated on ALL keyboards (at least for Linux and Windows). And the Linux HID gadget can receive these events. This meant there was actually a way to communicate with the manager using the lock keys on the system keyboard. I didn't need any display or button: just the Pi Zero, about as simple as you can get!

I decided on the following convention: Use the scroll lock light as an activation key since it isnt't used by MS Windows or the Linux windowing system. This would prevent accidental activation of the manager. It would cycle through system identifiers as long as all three lock lights were on. It would type a username when the caps lock light went off, and a password when the num lock light went off. Any time the scroll lock light goes off, the manager will stop and wait for all three lock lights to go on to begin the process anew. There was one problem: the Pi doesn't handle scroll lock. But with a little searching I found a way to make it work using Xmodmap.

THE UNIX WAY

"Simple programs, each doing one thing well, combined together to make a larger program." 

I decided to follow that philosophy with this project: a shell script handles the program logic, with two simple C programs handling communication with the HID Gadget device.

BANISHING SD CARD CORRUPTION

I decided to use my mini-init technique to limit SD card corruption. I found that with a little work the mini-init shell script could do double duty as the password manager shell script. I also added code to detect an attached keyboard and run the regular init process. That way I could use it as either a plain Pi Zero or a password manager. I could have a Pi with me at all times!

DISADVANTAGES

If someone has the manager, they have all the passwords, the same as a list of passwords on paper. So don't lose it!

BUILDING IT

Copy the latest Raspbian image (lite is OK) to an SD card.

NOTE: You can do the next several steps on another Pi. Just boot from the new SD card in the other Pi, do the steps, shutdown, then move the card to the Zero. That way you won't need the special keyboard and HDMI adapters.

BUILDING STRONG PASSWORDS

Did you know the Pi has a hardware random number generator? The following command uses it to generate random characters. I suggest you pick a twelve character or longer portion that contains at least one number for your password: sudo dd if=/dev/hwrng bs=512 count=1 | tr -c -d [:graph:]

USING IT

This site has been tested to display correctly using Gnome Web on the Raspberry Pi.