(by Thomas King - king[at]t-king.de - http://www.t-king.de)
Nowadays, every person is forced to remember lots of sensitive data to interact with machines during daily life. For instance, automatic teller machines ask for numerical passwords and email accounts are protected by using loginnames and passwords. For many good reasons passwords should be difficult to guess and every password should be used for one account only. In reality, this makes it quite difficult for the average person to remember all the different passwords. Hence, people tend to choose easy to remember passwords and many persons re-use their passwords in such a way that the same password is used for many accounts. Even worse, it is quite common to write down a often-used password and stick the note containing the sensitive information to a screen frame. All these facilitations of remembrance lower the burden for hackers to get access to sensitive data and abuse computers.
The idea behind Safe is that a user must not remember all her loginnames and passwords. Instead, the user utilizes her cell phone to store sensitive data in an encrypted way. Only a so-called root password is required to be remembered to get access to the data.
This concept works pretty well, because nowadays, cell phones are ubiquitous. Usually, cell phone owners carry the phones in their pockets regardless where they are going. So, running Safe on a cell phone means that passwords have no longer be to remembered and can be chosen as difficult as it can be. The only requirement is that the cell phone in question supports J2ME applications and root password will never be forgotten.
SafeDesktop provides the same features as Safe does but it runs on desktop machines. Java is also used for the implementation of SafeDesktop. This allows SafeDesktop to be executed on almost all modern desktop operating systems (e.g., Microsoft Windows, Linux).
A synchronization mechanism is part of SafeDesktop to keep the data synchronized between Safe and SafeDesktop.
A MD5 hash of the root password is stored on the mobile device and compared with the user's input that is requested at application's startup. If the hash of the user's input is equal with the stored hash, the IDEA cipher is used in CBC mode (of operation) to decrypt the data stored in an encrypted way. The password that the user entered at startup is used as key for the IDEA cipher.
Safe:
SafeDesktop:
A J2ME-enabled device that supports CLDC 1.0, MIDP 2.0, JSR75 (PDA Optional Package), and JSR172 (Web Service API (WSA)) is required to run Safe. Nowadays, any state-of-the-art cell phone should do the job.
For testing the J2ME wireless toolkit can be used.
To run SafeDesktop you need the Java Runtime Environment 6. The Java Runtime Environment can be downloaded for free from Sun Inc. and it is available for all major desktop operating systems.
Safe (latest version is 2.4.1):
Download website (currently unavailable) for mobile devices
jar file: safe.jar (currently unavailable)
jad file: safe.jad (currently unavailable)
Source code: safe_2.4.1.tar.gz (currently unavailable)
SafeDesktop (latest version is 0.9.8):
Web Start (currently unavailable) (please click this link if you want to start SafeDesktop)
jar file: SafeDesktop.jar (currently unavailable) (executable on Microsoft Windows, Apple Mac OS X, Linux)
Source code: SafeDesktop_0.9.8.tar.gz (currently unavailable)
Safe and SafeDesktop are distributed under the terms of the GPL.
Do you need help to get synchronization between Safe and SafeDesktop to work? Please read the step-by-step instructions.
A forum is available to facilitate discussion regarding Safe and SafeDesktop. Please feel free to post a message to the forum by sending an email to safe_and_safedesktop@googlegroups.com.
There are many ways of contributing to the project:
Spread the word about Safe and SafeDesktop.
Donate money to support the project developers. The money will only be used for project related bills (e.g., web hosting, latest J2ME-enabled cell phones).
Become a developer and contribute code to the project.
You are a user of Safe or SafeDesktop?
Please add yourself to the map to show others where you come
from.
Honor to whom honor is due. Special thanks for the following people who helped improving Safe and SafeDesktop:
Thomas Butter thomas[at]gmx.de - he is a great tester, JNLP guru, and my personal alpha geek ;-)
Daniel van Eeden daniel.van.eeden[at]myname.nl - he is a great bug hunter
Osvaldo Carosi osvaldo.c[at]terra.es - he is a great beta tester and bug hunter
Daniel Zielke mrsinister[at]web.de - he is a great supporter
David Hoover jazzdaq[at]yahoo.com - he is a great code reviewer, tester, and hacker
Carolin Bombardi - just a great person
Safe 2.4.1 (12/06/07):
Minor bugfixes (mostly typos)
Safe 2.4.0 (10/30/07):
Go-to (in list of entries) added
Menu reorganized
Safe 2.3.2 (09/07/07):
Change root password button moved
About screen added
Safe 2.2.6 (07/30/07):
Exception handling improved
Minor Bugfixes (Alerts)
Safe 2.1 (06/09/07):
Exception handling improved
Icon added
Safe 2.0 (05/18/07):
Settings added (import/export, automatic logout, and synchronization can be enabled/disabled)
Synchronization added
A lot of internal changes
All versions between 1.2.0 and 2.0 are developer releases
Safe 1.2.0 (04/06/07):
Automatic logout procedure added (warning screen is shown after 60 seconds of inactivity and after another 5 seconds of inactivity "Safe" is closed)
XML file handling improved
Minor source code improvements
Downgraded CLDC API to version 1.0 because no features of version 1.1 are used
Safe 1.1.0 (01/06/07):
A XML-based export and import added (JSR-075)
Minor source code improvements
Safe 1.0.4 (01/01/07):
Code improvements
Typos fixed
RecordStore handling improved (thanks to David Hoover)
The Palm prc file is no longer supported
Safe 1.0.3 (03/03/06):
Code improvements
Typos fixed
Updated bouncycastle (now using 1.31)
Kvm is no longer supported
Safe 1.0.2 (25/03/05):
prc-File for IBM J9 available for download.
Safe 1.0.2 (12/30/01):
bugfix - siemens sl45i persistant storage problems
Safe 1.0.1 (12/28/01):
bugfix - Nullpointerexception, starting "Safe" the first time
Safe 1.0 (12/21/01):
Bubblesort algorithm added
Some speed improvements
Source code is under GPL
Safe 1.0Beta2 (09/13/01):
Manifest file added
Changing the root password change is now possible
Safe 1.0Beta1 (09/10/01):
Initial version
SafeDesktop 0.9.8 (12/06/07):
Import and export improved
SafeDesktop 0.9.7 (11/06/07):
A special character bug in the synchronization management fixed
SafeDesktop 0.9.6 (10/30/07):
Statistics added
Process bars for encryption and decryption added
SafeDesktop 0.9.5 (10/25/07):
Minor GUI improvements
SafeDesktop 0.9.4 (10/18/07):
Minor GUI improvements
SafeDesktop 0.9.3 (08/14/07):
Web Start added
SafeDesktop 0.9.2 (07/31/07):
IPv6 problem fixed
SafeDesktop 0.9.1 (06/09/07):
Icon added
SafeDesktop 0.9 (05/18/07):
Initial release (all versions < 0.9 are developer releases)