Mooltipass: The Open-Source Hardware Password Manager

Introduction

The Mooltipass is a secure USB key password manager, designed to store and automatically inject your credentials in an encrypted manner, while remaining completely offline. Its goal: to offer a portable vault, difficult to compromise, even when connecting to potentially infected machines.

What is Mooltipass used for?

• Offline Storage: no direct access to encrypted content without the physical presence of the key and the entry of a PIN code.
• Automatic Injection: connects to a computer via USB and enters your logins and passwords into web forms or applications without ever exposing them in plain text on the screen or in RAM.
• Portability: carry the equivalent of a KeePass database in your pocket, without relying on cloud services.

Enhanced Hardware Security

1. Secure Chip
   • The Mooltipass uses a Secure Element on a provided smart card, similar to what is found in bank cards.
   • All encryption keys and PINs are stored there, protected from physical or software extraction.
2. End-to-End Encryption
   • Data is encrypted with AES-256 before being written to internal memory, and only the dedicated chip and microcontroller can decrypt it.
3. Protection Against Brute-Force Attacks
   • After 3 incorrect PIN attempts, the card permanently locks, thwarting any attack attempts.
4. Complete Component Separation
   • The open-source firmware isolates the USB "host" (data browsing) and "device" (injection) interfaces to prevent any accidental or intentional data leakage to the host computer.
5. Examples
   • The internal architecture of Mooltipass was designed with several independent chips. If a vulnerability on the Bluetooth controller were exploited, the attacker would only have control over that component.
   • Following a report from the community, the developer created a patch to ensure constant electrical consumption during PIN entry, so it cannot be deduced by a voltmeter that might be hidden in the PC's USB port.

Getting Started and Limitations

Strengths

• Security impervious to computer compromises
• Open source: code auditable by the community
• Cross-platform support via the Moolticute application

Difficulties and Shortcomings

1. Not Very Intuitive Interface
   • The menu on the small OLED screen, controlled by a single button, requires a learning curve.
   • Numerous settings are hidden in sub-menus.
2. Missing Features
   • No automatic synchronization between multiple Mooltipass devices.
   • Rudimentary management of attachments (secure notes, certificates).
3. Cumbersome Operation
   • Unlike a software password manager, the Mooltipass requires multiple physical manipulations, especially when the browser extension is not used (e.g., in another program).

Step-by-Step Usage Example

Initial Configuration

• Install Moolticute on your PC/Mac/Linux.
• Connect your Mooltipass and set a PIN code (4 hexadecimal characters).
• Create your first profile: URL, login, and password.

Automatic Connection

• Plug the key into your computer.
• Enter your PIN on the key and confirm.
• The extension automatically selects the account corresponding to the visited site.
• The login and password are automatically typed into the browser.
• For another application or without the extension, select the account from the list (Up/Down arrows + OK).

Adding a New Item

• From Moolticute, click on the "Credentials" menu.
• Fill in the fields (URL, login, password).
• Transfer them to the key by following the on-screen instructions.

Multiple Cards and Data Export

• Multi-Card
  • The Mooltipass supports multiple cards: you can share your keychain with a colleague by giving them a secondary card.
• Backup
  • A full backup is possible via Moolticute.
  • Backups remain encrypted until local decryption, ensuring no third party has access to your passwords.

Conclusion

The Mooltipass represents a robust solution for those looking to avoid the flaws of purely cloud-based or remote software managers. Its "all-hardware" approach ensures strong isolation, but its improvable ergonomics and lack of certain integrations may deter novice users.