PassStrong 3.0 Improved version with 8 different code, ability to export and restore a password vaults and several other improvements. See PassStrong and PassStrong 2.0 project for more informations I) The purpose of the device is to generate, store and type "strong passwords" (typically 32 characters generated randomly, which makes them impossible to guess), and to connect as a bluetooth keyboard to your PC or our mobile phone, and type this password. The device allow several (8 but can be increased) passwords, each can be associated with its own pincode, and its own 4 characters name ("HOME "WORK" "WIND"...), all editable by the user. Notes: You can't define the passwords yourself - they are generated by the device. The compilation / built instructions are in the code. This manual only focuses on using the device once properly compiled. II) How to reset and pair the device - If the device is blank (and it has not been pre-compiled with an exported password vault, see next section), you need to format it first. To format the device you need to press the small button while starting the device. It will definitively wipe all passwords, initialize them to random content with '0000' pin and the names to PIN0 ... PINF. To improve the security of you device you need to update the pins to less predictible numbers. - How to pair the device with your computer or phone: i - When you power the M5Stick, it tries to connect to a bluetooth device and shows the "Initializing" screen until connected to a bluetooth device. ii- At this moment, you need to pair the bluetooth device from your PC or phone. The name of the device should be "PassStronger3.0". NB: You should do this in a safe place, ensuring that no third party is present to avoid a potential "man in the middle" attack. III) Settings menu When the device is connected you see the main screen with the picture of 3 locks. This is the main menu. From this menu you can enter the "settings" menu by pressing the big button, or send the password using the small button (it will only work if the pincode is correct) The large button is the "mode" button. The small button is the "action" button. i) Press the "action" button for the PassStronger device to type the password to your computer or phone (you will see a "keyboard" screen while it does so). If the pincode is not correct, nothing will happen and you will see a "badpin" message. ii) Press the "mode" button once to enter the settings menu In this menu, you can press "mode" to move from one line to another, and to move inside the lines. The menu proposes 7 options, one per line: 1) Pin number entering or modifying. There are three different cases - Correct pin is entered and you are not in "pin changing" mode : in this case do nothing and press 'mode' 4 times - Pin entering : The first number is highlighted with a - at the top and bottom of the digit to be entered - press the "action" button to increase each digit of the pincode - press the "mode" button to move to the next digit, and once more to move to next section - Pin changing : a "<" sign appears after the pin code digits Use the same method as pin entering to enter a new pincode Pressing "action" on the last digit will setup the new pin and move to the next setting 2) Number (0 to 7) of the password to be typed in, followed by the 'name' of the password - You can change the first digit indicating the password number. - if you are not in "change pin" mode, pressing "mode" will move to next line - If you are in "change pin" mode ("<" sign appears after the pin code digit), you can edit the name of the password. 3) Pin changing mode ("Chpin") - If you are already in pin changing mode, a "#" sign will appear on this line. Pressing action will change the pin and update the name of the current password - If you are not in pin changing mode, pressing action will enter pin changing mode IF the current pin is correct. Then the cursor will move back to line 1 for you to edit pin. - If the pin entered is not correct a "badpin" message will appear 4) Keyboard language setting (AZERT or QWERT) - Press "action" will allow you to shift from azerty to qwerty keyboards 5) Test message ("Test") - Pressing action will type in a test message starting with the current time if the pin is correct. 6) Password regenerating ("Newpw") - This will do nothing if the pin is not correct. - Press "action" twice to erase old password. This will type the old password (so that you can save it if needed - after which it will be definitively erased on the device). - Then the device will generate a new password. - Note after this, there is no way to restore the old password. You should note it somewhere if you need to change your password on a site asking you for the old password first. 7) Key vault export ("Expor") - This will do nothing if the current pin is not correct. - If the current pin is correct, it will type a long sequence that you can use define the "initval" variable in the code to pre-format the device with given pins and names - You can also use this function to backup your vault in case you lose the device. -In this case, the sequence should be stored in a strongly crypted device to avoid a brute force attack on the vault. -After you restored the initval to a specific device, you should reflash it without initval to ensure that the device does NOT reset to initial after being wiped (if it does, brute force attacks are possible) IV - How secure is it ? 1 - If you are the only one accessing the device, if you pair it correctly (ie no "man in the middle"), if any bacp-uped vault if safely protected and if the initial parameters (AFactor, BFactor, CFactor) are wiped after compilation then you should be fairly protected 2 - If you lose the device, since ESP32's fuse & firmware encryption protection are flawed (and since you probably won't use them anyways) a- If it is stolen/found by an attacker with a good knowledge of this technology, or having enough time to acquire this technology can access your password b -If it is stolen/found by a less sophisticated attacker, the device will be wiped after MAXPIN pincodes entered 3 - In the case of a loss of the device, recommandation is to use a back-uped vault to flash a new device, and immediatly change you password before 2) happens.