Devlog 23

I added one really important thing. Before, Mossy used a 4-digit PIN to unlock the vault (it was used as a wrapping key (after going through HKDF and Argon2)). It was 10,000 combinations. Argon2 made it take longer, but after some time (a few hours), it could be cracked (if someone had your encrypted encryption key (sounds funny :d)).

After this change:

• We use PRF from WebAuthn (really secure stuff) that uses Touch ID, Windows Hello, or Yubico Security Keys (and others) to give deterministic random bytes. Think of it like a random function that remembers what it returned for which argument. Assuming that an attacker would try to brute-force this encryption key, even with 10^18 tries per second, it’d take 1.8 x 10^51 years to crack it (kinda looooong time).

• Oh, and for those who can’t or don’t wanna use PRF, I’ve added regular passwords. They’re not as good as PRF, but it still takes a really long time to crack those.

Those changes are still in an open PR, but it’s 10 PM, and I need to take a closer look at it tomorrow (already did a code review myself, but I’m kinda sleepy, and I’d like to keep y’all secure <3).

See ya!