Encryption in General
Psono uses established cryptographic components. At Psono’s core, we use Curve25519 and Salsa20 in the form of NaCl (pronounced “salt”), the Networking and Cryptography Library. Our server uses PyNaCl, while our frontend uses ecma-nacl. Both are well-established implementations of NaCl. Why not RSA and AES? RSA and AES are better known, but they are easier to implement incorrectly and are much slower. This useful article discusses the differences and the risks of using RSA and AES.
Encryption in Your Browser
Psono encrypts vault data, such as passwords and notes, in your browser using NaCl authenticated encryption before storing it on the server in a “secret object.” The encryption key is generated randomly and stored with metadata about the secret in your “datastore.” The browser application encrypts the datastore with a key derived from your password. We use scrypt as the password-derivation algorithm. Why not PBKDF2? PBKDF2 is better known, but its lower resource requirements, especially for memory, make it inexpensive to implement in hardware and easier for an attacker to crack.
Our Transport Encryption
Three encryption layers protect your data as it travels from your browser to our application server. The base layer is client-side encryption of the data itself. In addition, Psono implements an intermediate layer that we refer to as Psono’s transport encryption layer. This layer acts as a tunnel, similar to a VPN tunnel, between the website or extension running in your browser and our application server. As the outer layer, we use HTTPS (TLS 1.2). Both the intermediate and outer layers are built and configured to support perfect forward secrecy (PFS).
Regular Security Updates
Keeping software up to date is one of the best ways to protect any computer system. It helps defend against malware, viruses, and attackers and is essential for protecting your secrets. Psono recognizes this and releases regular updates with the latest security patches and features.
Open Source Principle
Psono’s core is open source and will remain open source. This means no license fees, no subscription costs that increase over time, and greater transparency into potential security flaws. You can migrate and host Psono anywhere with the partner of your choice, audit and check the code publicly, and fix bugs yourself if needed.
Service Availability
You need access to your passwords at all times. Psono addresses this in three ways. First, we provide our server and clients free of charge for on-premises hosting, with Docker making deployment as easy as possible. Our download page provides the corresponding Docker images for the Psono Server and Psono Web Client. Second, we provide a simple text-file backup function. Third, we run our cloud service on Amazon Web Services (AWS) and Google Cloud Platform (GCP), which minimizes the risks of data-center outages, data loss, and server problems.
Daily Backups of Your Data
We automatically back up all data from the Psono.pw service every night to provide the greatest possible protection against data loss. Access to these backups is restricted to a very limited number of people.
Code Safety Through Code Audits
We audit all new code. It requires manual approval before being put into production, and automated checks help ensure code quality.
Issue Minimization Through Automated Testing
We test all code automatically at multiple stages. It must pass several quality checks before it is considered ready to go live. You can find test-status badges here for the Psono Client and Psono Server.
Automated Vulnerability Scans
We use multiple security and vulnerability scanners to detect new threats and respond quickly. Automated scans run nightly and trigger notifications as needed. These scans also run automatically in our build pipeline, blocking vulnerable releases. Additional checks from third parties, such as GitHub, issue alerts for every new CVE.
Multizone Network Design
Our network follows best practices and makes full use of the security controls provided by our cloud providers. It is split into multiple layers, with firewalls between them, to restrict access and prevent or delay potential intrusions.
Advanced DDoS Protection
DDoS (denial-of-service) attacks are a serious threat to modern online services. Psono uses Cloudflare to mitigate the risk of outages caused by DDoS attacks.