|
1 | 1 | Passwords |
2 | 2 | ========= |
3 | 3 |
|
4 | | -.. note:: |
5 | | - You can store up to 50 passwords. |
6 | | - |
7 | 4 | Password entries may consist of: |
8 | 5 |
|
9 | | -* Login |
| 6 | +* Login name |
10 | 7 | * Password |
11 | 8 | * Comment (for e.g. a website reference) |
12 | | -* OTP (HOTP or TOTP) |
| 9 | +* One-Time Passwords (HOTP and TOTP) |
| 10 | +* Hash-Based Message Authentication Code (HMAC) |
| 11 | + |
| 12 | +.. note:: |
| 13 | + |
| 14 | + All fields are optional and can be edited and added at any time using the "Edit" button. |
| 15 | + |
| 16 | + You can store up to 100 passwords. |
| 17 | + |
| 18 | +.. figure:: ./images/credential-example.png |
| 19 | + |
| 20 | + |
| 21 | +Adding Credentials |
| 22 | +****************** |
| 23 | + |
| 24 | +1. To add a new entry click on the "Add" button. |
| 25 | +2. Enter your user name. |
| 26 | +3. Enter the password or OTP secret |
| 27 | +4. You can enter the web address to the field Comment. |
| 28 | +5. If you want to store a regular password, let "None" in the algorithm field. If you want to store a OTP or HMAC, choose the appropriate algorithm (see below) and copy the OTP secret or QR code that is given by the website (you want to login to) into the field next to it. |
| 29 | + |
| 30 | + .. figure:: ./images/TOTP-secret.png |
| 31 | + |
| 32 | + .. figure:: ./images/HOTP-secret.png |
| 33 | + |
| 34 | +6. You can choose to add more security by checking the "Require PIN" or "Require Touch" boxes. Credentials with "Require PIN" (shown as a closed lock) can only be accessed by entering a device the PIN when clicking on "Show Protected Passwords". Unprotected credentials (shown as an open lock) can be accessed without entering a device PIN. |
| 35 | + |
| 36 | +7. Once all desired fields are filled click on "Save". |
| 37 | + |
| 38 | +.. Note:: |
| 39 | + |
| 40 | + You need first to set a device PIN before using "Require PIN". Otherwise it will show an error. |
| 41 | + The device PIN can be set or changed in the `settings <./pin.html#passwords>`__). |
| 42 | + |
| 43 | +.. important:: |
| 44 | + |
| 45 | + You are allowed only 8 attempts to enter a device PIN otherwise you will not be able to access or create new credentials and you will need to perform a factory reset in order to use this feature again. |
| 46 | + |
| 47 | +Login |
| 48 | +***** |
| 49 | + |
| 50 | +Once your credential is stored you can login to your account with these steps: |
| 51 | + |
| 52 | +1. Select on the left side your Nitrokey on which your credential is stored. |
| 53 | +2. Click on the "Passwords" tab. |
| 54 | +3. Click on your desired credential, if your credential is protected click on "Show Protected Passwords" first. |
| 55 | +4. If it's a regular password, copy the username and the password into the login prompt. If it's a OTP credential, click the “OTP” icon to generate the OTP and enter the OTP code into the appropriate field in the login prompt. (For HOTP, press the button again to generate a new code.) |
| 56 | + |
| 57 | + .. figure:: ./images/TOTP-code.png |
13 | 58 |
|
14 | | -All fields are optional and can be edited and added at any time using the "Edit" button. |
| 59 | +OTP Algorithms |
| 60 | +************** |
15 | 61 |
|
16 | | -For a list of websites supporting OTP have a look at `dongleauth.com <https://www.dongleauth.com/>`__. |
| 62 | +One-Time Passwords (OTPs) are used as multi-factor authentication (MFA) designed to make it much harder for hackers to access protected information such as online accounts. |
| 63 | +With the Nitrokey App 2 and your Nitrokey you can use two different MFA: |
17 | 64 |
|
18 | | -Usage |
19 | | ------ |
| 65 | +* TOTP or Time-based One-Time Password is a two-factor authentication code that changes at regular time intervals (e.g. 60 seconds). This is the standard typically used by websites. |
| 66 | +* HOTP or HMAC-based One-Time Password is a two factor authentication code that changes each time it's requested and validated. It is rarely used today. |
| 67 | +* HMAC is primarily used with KeePassXC. |
20 | 68 |
|
21 | | -Entries are divided into two categories: unprotected (shown as an open lock) and protected (shown as a closed lock). Unprotected entries can be accessed directly. Protected entries can only be accessed with the PIN. |
| 69 | +.. Note:: |
22 | 70 |
|
23 | | -You can choose to create a protected entry by checking the "Protect with PIN" box when adding a new entry. |
| 71 | + For a list of websites supporting OTPs have a look at `dongleauth.com <https://www.dongleauth.com/>`__. |
24 | 72 |
|
25 | | -You also have the option to require user presence in the form of a required touch on the Nitrokey 3 to access the entry by checking the "Require User Presence" box. |
| 73 | +You can test TOTP with `this <https://authenticationtest.com/totpChallenge/>`__ website. |
0 commit comments