Hi!

I have been told that AVG antivirus (at least the free version) is detecting the passev installer as a Trojan horse (sHeur.CAFE trojan - sorry, couldn't find information in any antivirus database). As far as I know this is a FALSE POSITIVE . I have tested the program with Panda, McAfee and Karpersky antiviruses and all they have passed.

It seems that some heuristic test of AVG is launching this incorrect detection. I'm contacting AVG to inform them about this. The Passev installer is ABSOLUTELY SECURE AND FREE OF VIRUSES, as both my test and the tests ran by the many download sites where Passev can be obtained from have determined.

UPDATE

AVG Tech Support confirms that there is no trojan in the Passev Installer and that they are updating their database to avoid showing the false positive. Great service from AVG, as they have replied me in less than 8 hours! I'm reproducing the e-mail received from AVG below:

Dear Sir/Madam,

thank you for your email.

We analyzed your file and we can confirm, that it is a false positive.
The detection of this file will be removed in next virus update.

If you need to restore deleted files from AVG Virus Vault you can do
it this way: open AVG Virus Vault (Start -> Programs -> AVG Antivirus
-> AVG Virus Vault). Locate the file that was removed, right click on
it and choose "Restore File(s)" option.

We are sorry for the inconvenience.

Answers to the most common questions can be found here as well:
http://www.avg.com/faq/

     Best regards,

     Martin Hosnedl
     AVG Technical Support

Hello there,

Today is a happy day for me, as finally I have launched the first version of Passev after some hard work. You can get it from the downloads section.

Once installed, a configuration wizard will appear as sson as you start Internet Explorer to create your Passev account.  The password you use for this account is the only one you will have ever to remember, as Passev will remember the rest for you. VERY IMPORTANT: Do not forget your master password. There is no way to recover it if you lose it. This is by desing to put security to the max.

A new menu "Passev" will appear in the "Tools" menu of Internet Explorer to control Passev behaviour.

Please, keep in mind that this is a first, beta version of the application, so there may appear unexpected problems with it despite of all the testing I have done. 

I will be happy to hear your suggestions, opinions and ideas about it. Please use the contact form or the comments below to let me know what you think.

Thanks ad I hope you finds the program as useful as me!

 MacK

Passev beta 1 is almost ready to be launched. Just some details left to be finished and it will be published here. I'm still looking for betatesters, so if you want to be one of them, please send me a mail using the contact form.

Hi there! Passev is quite advanced. I would like to test it with more people, so I'm looking for betatesters willing to have a look at it.

Would you like to colaborate? Send me a message using the contact form, i'll get in contact with you soon.

As is every good development :) Passev is delayed. The crypthographic part is taking me more time than expected, as I want to be sure I'm not leaving any security hole. Due to this, Passev launch is going to be delayed about two weeks, so the new release date will be July 15. Sorry for the inconvenience!

Last week I told you about how PassEv will ensure confidentiality by using a shared session key. Today I'm going to talk about how the program will encrypt the local file containing our passwords, or the PassStore, as I'll call it from now on.

A suitable algorithm to  encrypt the data should combine some features: it has to be impossible to crack in a decent time and has to be quick enough to be used so the user hasn't got to wait 15 minutes till the encryption is done. After studying "modern" algorithms, I have decided to use AES, which is a small, fast, hard to crack encryption standard and is suitable for a wide range of devices or applications. It has been determined as the best compromise between a combination of security, performance, efficiency, ease of implementation and flexibility.

128 bit AES offers a total of 3.4 x 10^38 individual keys. It is estimated that if an AES key generator were able to discover 1 AES key per second, it would take 149 thousand-billion (149 trillion) years to crack a single 128 bit AES key.Currently, the technology is not available.

Passev is planned to be released the 1^st of July. Stay tunned if you want to betatest it! 

This week I have been thinking about how PassEv, the passwords sync utility I'm working on, should work to ensure the confidentiality of out data, where our data means our user / password combinations for the sites we usually work with. The local security (encrypting local data) is easily done by using a symmetric key algorithm. PassEv will use the master password (the only password you will have to remember once you start using the program) to encrypt the passwords store (or PassStore) using a symmetric key algorithm. But once we have the data encrypted, we want them to be sync'ed in all our computers. That is what PassEv if intended to do.

That means that the local copy of PassEv will have to send the encrypted PassStore to the PassEv.com server, and that other computers using PassEv will have to be able to retrieve the PassStore. Me, as user, should be able to get my PassStore and only my PassStore (not any other one). So we will need a user (the master user) to create an account in the PassEv.com server, so the different PassStores are linked to their owners. To retrieve the correct PassStore from the PassEv.com server, PassEv will have to send the master user / password combination. And here is where PassEv has to ensure confidentiality again. It cannot send the master user /password combination in clear text over the net without encrypting it, or anyone "hearing" our line will be able to decrypt our PassStore and obtain our saved passwords.

To encrypt, the PassEv program and the PassEv.com server must negotiate a password and encrypt all their communications using it. To achive this, I'll use a "shared session key" approach. The PassEv program will generate a random password each time it starts a session with the PassEv.com server. All the communications for that session will be encrypted using that key. To be able to transmit the session password to PassEv.com server without compromising it, the program will encrypt it by using a public key algorithm. That is, the PassEv.com server will generate a private / public key pair and the PassEv program will encrypt the "shared session key" negotiation with the public key. Only the PassEv.com server can decrypt that using its private key. Once this is done, we will have a secure way to send the PassStores over the http connection. When the sessions ends, the shared session key is forgotten and a new one will be used in a futher session, increasing security.

I have wrote a description of the PassEv security scheme here.

Questions? Doubts? Ideas? Suggestions? Just leave a comment!.

NOTE: PassEv is intended to be released on July the 1^st

As a heavy Internet user, I have personal accounts on dozens of sites. For security reasons, I don't like to use the same password for them all, so I also have dozens of different passwords. As I also want to avoid using a common way of creating the passwords (so anyone knowing one of my password could find out the rest of them), this has lead me to a cloud of passwords in my head. Oftenly I am not able to remember the password for a particular site. I try and try and end clicking the "Forgotten password" link..... when it exists, because sometimes it doesn't and I have to create a new account. A pain.

I have the "remember passwords" feature enabled in Internet Explorer, but this only helps half of the times. If I use my laptop, or worst, the office's laptop, I'm lost. The passwods are only stored in my desktop computer. I don't want them in the office's laptop, as sometimes it's used by other people ,but I need the passwords  in all my computers, being sure that they are secured and that no one can get them but me.

This is why I have decided to start the PassEv project. PassEv stands for Passwords Everywhere and it's a small utility wh¡ch will store my passwords securely and synchronize them in all my computers. You can get a better description of the project in the PassEv description page. Currently the PassEv Sync utility is planned to be released on July. Do you think it could be useful for you? Stay tuned and keep an eye on this page.

Thank you for reading, and remember you can leave any questions as comments below.!