Google requires you to configure your account in order to allow the access to the mailbox from external tools. However, yesterday I decided to try and simply authenticate via IMAP on a brand new Gmail account.

Surprisingly… it worked because recently Google changes the default settings. In ten minutes I reversed the code substituting the old library with just two lines.

So the good news is “we fixed it”. The Gmail third party authentication will not be discontinued.

.

(instructions & FAQ here if you need them)

What’s New?

• Many of your favorite features from Passpack.com:
  • bulk entry management
  • see your people tab (read only)
  • click icons to copy content from your list
  • updated entry window
• Offline only entries clearly marked with “local” tag.
• Sync and view shared passwords [hooray!]
• Sync tags and favorites settings from online (optional)
• And the ever-important: shiny black chrome

Passpack Desktop is Your Best Backup

Should you ever get stuck without an internet connection – you’ll be really happy you have a copy of all your important passwords in your Passpack Desktop.

So install it now.

If you have never installed Passpack Desktop before, or do not know how to synchronize it, it’s pretty easy. Just read the instructions here.

* Two notes for beta testers: (1) Just go to Tools > Downgrade to stable version and your Beta version will be upgraded to the latest stable release. (2) Thank you!!!

Here’s what’s new:

• Many of your favorite features from Passpack.com
  • bulk entry management
  • see your people tab (read only)
  • click icons to copy content from your list
  • updated entry window
• Offline only entries clearly marked with “local” tag.
• Improved online sync, including shared passwords [hooray!]

Want To Test It Right Now?

You can. No need to sign up for a beta program, simply download a copy of the beta at the link below and get cooking. We’re announcing this on the blog first so you guys can get the first crack at it.

Download
Testing is over – thank you! You may download the latest release here.

Instructions
Testing is mostly needed on the update and sync process, so you must, must, must backup your previous Desktop data before testing! Then install the beta. To align your data with your online account, go to Tools > Sync with Passpack.com.

Should anything go wrong, let us know what happened. If you need to recover your data, use the command Tools > Downgrade to stable version.

Feedback
Please use the comments below to let us know what’s working, and what’s not. That’s it, enjoy. I’m looking forward to your feedback.

Update 12/4

Before installing the beta 2, please launch beta 1 and click the “BETA: restore old 1.0.5 pack backup and restart.” link (if you don’t have that link, it’s ok, it means you don’t need it). Then you can close it and install beta 2.

Changes made:

• Fixed the blank password field
• Fixed the password history
• Minor tweaks

Thanks, keep letting us know what you find.

Tara met Stina Ehrensvärd, CEO & Founder of Yubico, during Red Herring’s ETRE 2008, in Stockolm. In that occasion, Stina gave a Yubikey to Tara. I pondered it for a while, and now we have finally decided to do an integration. Actually… two.

You can use the Yubikey either as a Two Factor Authentication between your Passpack Password and Packing Key… or you can use it to replace the Passpack Password and skip straight to the Packing Key.

Option 1: Yubikey as a Third Party Login

As usual, if you want to associate the Yubikey login to you account, go to Account > Associate Another Login and start the process (how to).

If you are not already a Passpack user, you can create an account directly using one of the supported Third Party Logins, now including Yubikey. Of course, I strongly suggest to have a standard Passpack account as well for back up. In fact, in the case that it is not possible to access your Third Party service  for any reason (did you loose your Yubikey?), will then be able to access your account via the standard sign in process. Alternatively, you could associate al least two Third Party Logins.

Option 2: Yubikey as Two Factor Authentication

This is for people who want to further secure their access to Passpack.
To configure your account to use Yubikey, simply go to Settings > Two Factor Autentication. You will see the following screen.

Choose the second option and press Continue. Passpack will then ask you to press your Yubikey and … you’re done.

Please note: Some Internet Cafès or public computers may not allow you use a USB drive for fear of keyloggers. In these cases, you will not be able to access your Passpack account from those computers.

This is a first roll-out using a  one time code which will be sent to you via email during sign in to your Passpack account. You can choose the email you’d like to receive the code at, and whether or not you’d like it to be required all the time, or (my favorite) only when your Welcome Message is inactive.

This feature is completely optional. To set up a second factor of authentication, choose Two Factor Authentication from your Settings menu.

Two Step Login AND Two Factor Authentication

Passpack uses a two-step login. First step, the user has to be recognized – with User ID and Password or via a 3rd Party (Yahoo, Facebook, Twitter, etc.), second step is our famous Packing Key.

Most of you know that your Packing Key is known only to you and decrypts your data directly in the browser. But what some of you may not realize is that we also use it as an additional authentication step. This is because your data will only be released by the server to your browser if a hash of your Packing Key matches the one stored.

This approach is clearly safer than any other two-step approach. So, we have always been reluctant to add a “traditional” second factor of authentication. However, since there are a few users that periodically ask us for it, we decided to introduce some form of Two Factor Authentication.

We started with a simple one: a One Time Password (OTP) via email.

How to Set Up Two Factor Authentication

Go to the Settings tab and launch the command Two Factor Authentication. Passpack verifies the configuration and lists the available factors. Continue and, in the next screen, choose the email address where the OTP will sent. Also, you can choose to activate the second factor only when your Welcome Message doesn’t appear – for example, when you aren’t connected with your own PC.

In the next step Passpack will send you a test OTP to verify that you can receive it without issues (ex. excessive waiting time, anti-spam filters, etc.). Simply check your mailbox, copy the OTP from the message and paste it in the field to complete the process.

Please be aware that if you set this up, you must have access to your mailbox before logging into Passpack (don’t create a catch 22 folks!).

* Sorry, just HAD to get a reference to the turkey in here somehow [wink]

We temporarily sidestepped the problem avoiding the creation of new accounts via Google/Gmail, and immediately after this, started to work on the support of Google Friend Connect.

It was a bit complicated because Google Friend Connect doesn’t support SSL. We had to work around this limitation with some tricks in order to mantain the usual level of security, and without any nasty browser alerts.

Also, we added a notice for the users that usually access to Passpack via Google/Gmail. The message suggests you associate a new Google Friend Connect logon to your account instead of the old Google/Gmail logon.

IMHO, the new signin via Google Friend Connect is faster and more comfortable then the old one. I hope that you enjoy it.

Now, I can get back to work on the new Passpack Desktop.

I analyzed it and I discovered that Google has changed how Gmail authentication works, causing the library we use to fail. As result of this, we are preparing to support Google Friend Connect. In the meantime, it will not possible to create new accounts via Google or Gmail, but only to access to existing ones.

How the interface changes.

Instead of two fields, the Gmail address and the Password, you will only have one: the Gmail address. Please note that this will work only with existing accounts and it will not possible to create new accounts via Google/Gmail.

And about security?

When you type your Gmail address, Passpack will check if it exists and that a Passpack account is associated to it. If so, you will be asked for your Packing Key. As you probably know, only if the hash of the Packing Key is correct you receive your encrypted data. So the first step is just a way to recognize who you say you are. The second, the request of the Packing Key, guarantees the security of the access. Also, if you didn’t set a Welcome Messsage, in order to safeguard your privacy, the welcome screen will show your Gmail email address without the “@gmail.com” suffix instead of your Passpack ID.

The next step.

Once the Google Friend Connect support is ready, you will be able to associate it to your account. UPDATE Google Friend Connect is ready. Please follow these instructions to associate it to your account. You should also remove the current Google/Gmail association as we will phase it out quickly.

More Auto-login Improvements

We’ve managed to nearly complete the browsers compatibility list. After the last release, a few users were concerned that the Passpack popup was being blocked by NoScript. Francesco and Giorgio Maone had a quick phone call on how to possibly solve the issue. In implementing those changes, the side effect was a better browser compatibility. Alas, it still doesn’t work with NoScript. Here’s the list:

• Firefox 3+ (maybe 2 as well… you tell us)
• Explorer 6, 7 & 8 (IE6 is still quirky, but “works”)
• Chrome 2+
• Safari 4
• Opera - Sorry, still working on compatibility.

We also incorporated bug fixes in and around the handling of 1 Click Login vs. Click Through from your account logging in. We’ll continue with even more improvements.

Email Single Entries – No Bulk Edit Required

Click on an entry and have a look in the lower left-hand corner for the “email this” link. You can now send an encrypted entry to any person with an email – not just the folks in your People tab. We first introduced this feature as a Bulk Edit option, and have now extended it to single entries as well.

Wait, passwords via email?! No, no. Of course not. The entry will be encrypted and set aside securely on our server. Then a notification will be sent to your friend’s email, something like this:

Time Saving Trick

Want to quickly rename an entry? No need to open it up, just hold down “E” on your keyboard and click on the name in your list.

Type away then press ENTER to commit the change, or ESC to cancel.

You can do the same with your tags as well.

Last But Not Least – Thank You Beta Testers!

My mother would have my head if she found out we released Auto-login 2.0 and haven’t yet thanked our beta testers (she’s actually on Facebook, so please no one tell on me [wink])! So without further ado, here they are in random order:

• Gregor Lütolf
• Justin Maloney
• J. Allen R. Day
• Deltapi
• Paul Reed
• Roy Kolak, Noteworthy App
• Kevin He
• Bobby Brenman
• Greg Davis, Technically Speaking
• Diwaker Gupta, Floating Sun
• Max Sanna, Vision with Technology
• Clemens Lang, Never Panic
• Crístian Deives, cd1 on Twitter
• … and all the shy folks who preferred not to be named, as well as the humble ones that claimed “unworthiness” (you guys are silly!)

Thanks everyone! Also, to those of you who wrote into customer support to let us know the glitches you were running into – your help was very much appreciated. Please continue to keep us informed.

Greg Davis

The Auto-login 2.0 release is going well so far. But we’ve found some special cases when you might prefer version 1.0. So we have added the option to switch between versions.

When Would This Be Useful?

Example 1: The new Passpack It! button works well on Firefox 3+. However certain plugins, for example NoScript, may cause it to fail. Auto-login 2.0 release uses iframes as a sandbox to avoid Cross-Site Scripting (XSS), yet NoScript blocks all code running in iframes. There’s no fix for this. So, if you are a Firefox-NoScript user, you will need to switch back to the older version. Other plugins or settings may cause similar problems.

Example 2: On Chrome 2 and Safari 4, the new Passpack It! button works sometimes, but not always. For this reason the Auto-login 2.0 release was not activated by default. However, if you really want to, you could try the new version.

The option to switch is available under Auto-login > Install your button.  Scroll down to the bottom of the page and read the instructions. You can always reverse this action if you want.

Want To Help Test?

Naturally, if you would like to help us complete testing Auto-login 2.0 on browsers that we have not officially supported yet – use this option to force Auto-login 2.0 and let us know how it works.

If you already have a Passpack account, you need to reinstall your button. Here’s how. Check the browser compatibility below (scroll down). If you run into any issues, please let us know.

So What’s It Do?

• NEW – Double-click your button to get a full options pop-up
• NEW – Add a passwords to Passpack from anywhere on the web
• NEW – If all else fails, Copy/paste from the options pop-up
• NEW – Find a broken link? Send feedback quickly from the options pop-up

• Improved performance logging you into websites.
• Multiple logins for one domain? No problem. Now has copy/paste too.
• Improved training websites to login

This new release adds a few options and a ton of flexibility to the system. It was also an interesting battle to hop through all those crypto-hoops to make it work. Far too much for this post to cover, so I’ll go into more details in some follow-up posts. In the meantime you can go to Auto-login > Options for power users to play around.

Browser Compatibility

This is a first roll-out. We’ve got about 80% of our users covered.

• Firefox - Versions 3+
• Explorer- Versions 7 & 8. Explorer 6 is not supported.
• Chrome - Version 3 supported (but don’t use it [wink]). Version 2 still working on compatibility… it’s oddly very buggy.
• Safari - Still working on compatibility. The double-click on the button definitely won’t work, but there will be a work around for that.
• Opera - Still working on compatibility.

If your browser isn’t compatible, you can continue to use your current button – it’ll work just fine.