network-programmingnetwork-securitysecurity

hardware based password manager integration with device


I am aiming to build a hardware based password manager that will store credentials like -username and passwords- externally, right now I am searching about it but I am having trouble in identifying that how will that external device integrate with browsers and websites when connected to provide the credentials stored in it. I mean what technique is used to integrate the hardware password managers to the device or browser.

I would appreciate any sort of help and guidance from your side, Thanks!


Solution

  • Usually they inject passwords using a HID device acting as a keyboard. Check out the OnlyKey as an example.

    The way these work is by injecting/typing username and password based on pressing a hardware button against which you have stored the relevant credentials. There is also the option to complete MFA by storing an OTP token. Some will act like any other password manager by parsing the website URL against what is stored, but I guess this opens an attack surface when feeding data back to the device.

    -- BVS