Locke Password ManagerLocke Password ManagerLocke protects your business against both insecure passwords and phishing attacks by preemptively stopping your users from visiting malicious websites and allowing you to centrally manage important company passwords.
Locke implements a security model inspired from and improved upon that of Bitwarden. All passwords are encrypted client-side using a symmetric key. Instead of AES we use the superior XChaCha20 encryption algorithm. The symmetric key is encrypted with a master key derived from the master password using Argon2id, before being stored. All passwords and keys are then encrypted again on our servers using normal AES 256.
Unlike Bitwarden, Locke does not use asymmetric encryption to encrypt keys or passwords that are stored server-side. This design decision was made since RSA and ECDSA are vulnerable to Shor’s algorithm. While quantum attacks on public key cryptography are not feasible now, data can be vacuumed up by state actors and decrypted later.
Security and usability don’t have to be mutually exclusive. Despite it’s popularity, SMS is not a secure channel to perform MFA. Instead, our MFA uses a 7 digit code presented on screen along with a QR code to be typed or scanned into our mobile app. In the event that a person is locked out on both devices, a hardware token is generated on app install and can be used to authenticate without an authenticator app.
The mightiest castle is vulnerable if attackers have a key to the front gate. In the same vein, all this encryption accounts for nothing if your employees give hackers their passwords. Locke Armory integrates an adaptive phishing filter into our browser extension that stops your users from visiting malicious websites.
Locke Armory provides an admin console where you can manage vaults, share access with employees, configure white and blacklists, and importantly: view detailed logs on phishing & login attempts.
This feature is currently in development with a release date slated for the end of October.
For all features described above, along with white glove support. Contact us for pricing for large teams. We’re a startup and able to accommodate most budgets.
Our mission is to provide seamless & secure access into everything on the Internet. The final form of this obsession with usability is something called Continual Factor Authentication (abbreviated as CFA). Instead of ever requiring a password or fingerprint, Locke can check that you are who you say you are in the background all the time using passive signals you generate such as typing pattern and gait.
With CFA we can generate finely scoped authorization tokens that are tied to one specific action. Once that action is taken, the token is revoked. These action-based tokens can create a super high “resolution” auth system that has the unique property of perfect internal visibility, allowing enterprises to counteract cyber attacks as they happen.
