After reading a lot of articles on ramping up the security of my web accounts, I started using aWallet Password Manager for
Android to backup my passwords. I like it for following reasons:
- I'm able to have fairly good-entropy passwords: I'm able to throw in a mixup of lowercase & UPPERCASE alphabets, digits, special characters (including spaces) and have reasonably long passwords (10+ characters)
- Saving my passwords securely allows me to have distinct passwords for each web account which would otherwise be impossible. This would avert a cascading effect (giving away credentials of all accounts) that would be created if one of my accounts, whose login credentials I share with several accounts, gets compromised.
Needless to say, that 2nd point is debatable because having all credentials stored at a single place introduces a single-point of failure and poses an equal risk of the chain-reaction mentioned earlier.
Given my limited knowledge of
Cryptography and doubts around privacy (given recent incidents of online thefts), I want to testify the security of
aWallet Password Manager before storing my Banking / Card details in it. Here's what they claim on their Google PlayStore page:
• All data is encrypted, including Entry names, Category definitions and the data itself.
• Encrypts data using AES and Blowfish algorithms with key sizes of 256, 192 and 128 bits.
• When the data file is decrypted, up to all combinations of algorithm, key size and cipher mode of operation (CBC, CFB, OFB and ECB) are tried with the Master password to unlock the data file. This makes brute force attacks longer. The app itself does not store any hint to the actual cipher, key size or cipher mode of operation.
• Uses a randomly generated 'salt' combined with the Master password. Salt helps to protect from off-line dictionary attacks.
• The key to open the data file is created by combining your master password with the 512-bit 'salt'. The result is hashed 1000 times by SHA-256. Repetitive hashing makes a brute force attack more difficult.
While none of these points make a lot of sense to me, the little bit that I know about
Cryptography tells me that repeating a
Cipher multiple times doesn't Mathematically improve the security ; it may only give one a false impression of added security. And because of this inconsistency, I started doubting the validity of their other claims.
Could you elaborate their claims / point me to some source where I can get an overview of the concepts to eradicate my suspicion; so as to prove or disprove the level of security offered by aWallet Password Manager?