Web Confidential for Palm OS
Palm Desktop for Mac v.4.2.1 Palm Desktop for Mac 4.2.1 is such a professional tweak tool which includes the Palm Desktop and HotSync Manager software developed specifically for the Macintosh. It includes Palm Desktop software and all-new HotSync Manager software, complete with. Palm Desktop 4.2.1 for Mac enables synchronization of a palmOne handheld with the Date Book, Address Book, To Do, Memo Pad, Note Pad, and Voice Memo applications, as well as backup functionality for Palm Photos. Has released Palm Desktop 4.2.1 Rev D, an updated version of the software that allows Palm-branded PDAs to synchronize data with Mac OS X.The software address permissions problems.
Web Confidential
for Palm
User’s Guide
Version 1.4
WWW: <http://www.web-confidential.com>
E-mail: <>
Copyright, © 2000-2004 René Laterveer and Alco Blom
All Rights Reserved.
Product design by
Alco Blom
<>
Software and manual written by
René Laterveer
<>
Encryption algorithm
Bruce Schneier
Original manual written by
Colin Brace
Introduction
by Alco Blom
If you are anything like me, you've probably got a growing number user IDs, passwords, registration keys, PINs, serial numbers, and the like, stored in various places on your Mac or scribbled on miscellaneous pieces of paper around your home or office. When you stop and think about it, you probably have more of these pesky bits of information scattered about than you realize.
The proliferation of the Internet is exacerbating this situation. Increasing numbers of commercially-oriented sites, such as the NY Times, require some form of registration even simply to view content. Other transaction-oriented sites, such as Amazon.com, or personalized sites, such as My Yahoo, require passwords for personal services. Many sites now use cookies to track users, but if your cookies files get deleted or corrupted, you'll have to re-enter your usernames and passwords.
I decided to write a software program to manage passwords and the like; it is called Web Confidential. It uses an intuitive, easy-to-use cardfile metaphor which will enable even novice users to get up to speed in no time. Power users will find a large number of options to enable them to configure Web Confidential to meet their specific needs.
Last but not least, Web Confidential permits you to encrypt your password files, protecting this sensitive information from prying eyes, using the state-of-the-art “Blowfish” algorithm [1]. The Blowfish algorithm was published four years ago, and has been proven extremely resilient to cracking. No known successful cryptanalysis against Blowfish exists.
Web Confidential supports keys of up to 448 bits in length.
Note: Macintosh and Windows versions of Web Confidential are also available. Please check <http://www.web-confidential.com> for details.
[1] - Applied Cryptography, Bruce Schneier, 1996. John Wiley & Sons, Inc.
(see also <http://www.counterpane.com/blowfish.html>)
Web Confidential is a Palm OS program. It runs on Palm OS compatible devices with Palm OS 2.0 or higher.
Please try Web Confidential for Palm OS to see if it runs without problems on your device.
Web Confidential uses about 60 KB of storage on your Palm.
Mac OS and Windows versions of Web Confidential are also available separately. A Conduit is supplied to synchronize data between your desktop and Palm.
To synchronize with the Windows version of Web Confidential you need a PC with Windows 95 or higher and Palm Desktop 3.0 or higher.
To synchronize with the Macintosh version of Web Confidential you need Mac OS X 10.2 or higher and Palm Desktop 4.0 or higher. We recommend Palm Desktop 4.2.1 or higher.
Limitation of Liability
Under no circumstances including negligence, shall René Laterveer, Alco Blom or Arno Stobbe be liable for any incidental, special or consequential damages that result from the use or inability to use Web Confidential, even if René Laterveer, Alco Blom or Arno Stobbe have been advised of the possibility of such damages.
Support
Web-Confidential-Talk is a mailing list dedicated to the discussion of Web Confidential. The authors of Web Confidential participate on the list and provide support. To subscribe to Web-Confidential-Talk:
Send a message to: <requests@web-confidential.com>
Start the body with: subscribe Web-Confidential-Talk
Or contact the author at: <palm-support@web-confidential.com>
Web Confidential is distributed under the so-called “shareware” principle. This means that you are expected to pay a modest registration fee of $20 if you continue to use the program beyond a trial period of 30 days. Within this trial period, you have full access to all of Web Confidential's features. After thirty days of use, you cannot add new cards but you can continue to view and edit existing cards. Upon payment of the registration fee, you will be issued a registration key which removes these restrictions. Payment of the registration fee entitles you to subsequent incremental upgrades. In addition, the wishes of registered users will be taken into account in future enhancements of the program.
Although freely distributed via the Internet and on CD-ROM collections, Web Confidential is not public domain software; it is commercial software which is professionally developed and supported. It represents many hours of work by its developer, whose primary source of income is derived from the development of shareware software. Your registration payment ensures the continued viability of high-quality software developed by independent developers committed to the Palm OS.
We trust that you will honor the shareware concept and register Web Confidential if you continue to use it. To encourage you to pay the shareware fee, the unregistered version of Web Confidential has the following restriction:
After 30 days of use, you cannot add any new records. However, you can still view and edit your existing data.
After you register the program, this restriction is removed.
Web Confidential for Palm costs $15. You can register on the WWW using this URL:
<http://order.kagi.com/?AB>
Web Confidential for Macintosh or Windows are separate order items and costs $20. If you want both the desktop and Palm programs, the price for the bundle is $30.
There is a special bundle price if you also purchase URL Manager Pro. The bundle price is US $50, including three programs. URL Manager Pro is the professional bookmark manager for the Mac.
Please go to: <http://www.url-manager.com>
To install Web Confidential start the install program “Install Web Confidential Bundle.exe” which you can download from <http://www.web-confidential.com>.
- Click the Next button and you will be presented with the following window.
- Choose to install the Palm OS or desktop version of Web Confidential. The default is to install both.
- Click the Next button and follow the instructions. The Conduit will be installed and configured and the Palm application will be prepared for installation on your device.
- Start a HotSync to install Web Confidential on your device.
- If you are trying Web Confidential for Palm you are finished now. If you also use the desktop application see the section HotSync below to setup the Conduit and install your desktop file.
Updating from a previous version
Before you update from a previous version we recommend that you first make a backup of your password database.
The standard Backup Conduit only makes a backup of the Palm password database if it is encrypted. Therefore lock your passwords on the Palm and perform a HotSync. The encrypted Palm database is in a file with a path like “C:PalmUserBackupWeb_Confidential_Database”. The exact path depends on your user name and where the Palm Desktop has been installed. Make a copy of the file in a secure place.
You can now install the new Palm application and Conduit as described above. You don’t have to remove the previous version from your device.
Make sure that the desktop file is upgraded to Web Confidential for Windows version 2.1 or later.
- Open your file in the latest version of Web Confidential for Windows.
- Make a small change like adding a record.
- Save your file.
Removal
Remove Palm application from your device by tapping the Home icon, select the App/Delete menu and select “Confidential” and tap Delete. The Web Confidential application and all its data will be removed from your device.
To remove the Web Confidential Conduit click “StartSettingsControl PanelAdd/Remove Software”, select “Web Confidential for Palm” and click “Remove”.
Installation for Mac OS
The Macintosh version is supplied with an installer. The installer automatically detects the default Mac OS X language and installs the right language version of Web Confidential for Palm OS on your device.
Double click “Web Confidential for Palm Installer” to start the installation. You will see the following dialog.
The language depends on the default Mac OS X language you have chosen. Select the HotSync name of your Palm and click the “Install” button. The Palm application will be copied to your Install folder and the Confidential Conduit into the Conduits Folder. Put your Palm in the cradle and push the HotSync button to transfer the Palm application.
Please note that you need Administrator privileges to install the Conduit. If the Conduit is not installed by the Installer then you can download the Conduit from the link below and copy it by hand in the folder “/Library/Application Support/Palm HotSync/Conduits/”.
<ftp://ftp.web-confidential.com/pub/osx/conduit.sitx.bin>
If you are trying Web Confidential for Palm you are finished now. If you also use the desktop application see the section HotSync below to setup the Conduit and install your desktop file.
Updating from a previous version
If you use the Macintosh Conduit make sure it is set to “Synchronize” and that the right desktop password file has been selected. Unlock the password database on the Palm and perform a HotSync. You will now have a backup of your Palm passwords on the desktop.
If you don’t use the synchronization with the desktop version you can find a backup of your passwords in a file with the name “Web Confidential Database.pdb” in your Palm user folder. You can find your Palm user folder inside the folder “Documents/Palm/Users” inside your Home folder. The exact path depends on your user name. Make a copy of the file in a secure place.
You can now install the new Palm application and Conduit as described above. You don’t have to remove the previous version from your device.
Make sure that the desktop file is upgraded to Web Confidential for Macintosh version 2.2 or later.
- Open your file in the latest version of Web Confidential for Macintosh.
- Make a small change like adding a record.
- Save your file.
Removal
Remove Palm application from your device by tapping the Home icon, select the App/Delete menu and select “Confidential” and tap Delete. The Web Confidential application and all its data will be removed from your device.
To remove the Web Confidential Conduit drag the file “Confidential Conduit” from the folder “/Library/Application Support/Palm HotSync/Conduits/”.
Expand the ZIP-archive “confidential-palm.zip” and install the file “Web Confidential.prc” on your device.
Removal
Remove Palm application from your device by tapping the Home icon, select the App/Delete menu and select “Confidential” and tap Delete. The Web Confidential application and all its data will be removed from your device.
There are fourteen categories in Web Confidential:
- WWW Sites,
- WWW Forms,
- FTP Servers,
- Newsgroups,
- Login Accounts,
- Email Accounts,
- Online Banking,
- Bank Accounts,
- Credit Cards,
- ATM/PIN Cards,
- Personal Data,
- Software Keys,
- Serial Numbers,
- Membership Numbers
- Miscellaneous.
With regard to the WWW, you can use the categories 'WWW Sites' and 'WWW Forms'.
There are two types of Password Protected Web Sites. One type uses HTTP Authentication to gain access to a web site. You will know if the site is using HTTP Authentication because when you try to bring up the site, a dialog box will appear asking you for specific password information. Please store this information in the 'WWW Sites' category. The other type of Password Protected Site asks for a password via a web form. Therefore, you would actually enter your information into a web page rather than a dialog box. Store these passwords in the category 'WWW Forms'.
In 'FTP Servers' you store your user ID and password to get access to password- protected FTP Servers.
In 'Newsgroups' you store your user ID and password to get access to password- protected newsgroups.
In 'Login Accounts' you store information you need to access the various UNIX and PPP accounts at ISP (Internet Service Providers) you have.
In 'Email Accounts' you store the passwords you need to retrieve mail from your various mailboxes.
In 'Online Banking' you store the web pages and access information of your several banks.
In 'Bank Accounts' you store the bank numbers you have.
In 'Credit Cards' you store the numbers and expiration dates of your credit cards.
In 'ATM/PIN Cards' you store the numbers of your ATM/PIN cards.
In 'Personal Data' you store data like your drivers license, your insurance policy, your social security number.
In 'Software Keys' you store all the registration numbers or software keys that you have received after registering software programs.
In 'Serial Numbers' you store the serial numbers of various equipment that you have in the house. The serial numbers of your VCR, TV, HIFI, PowerBook and Mac. You might need them if they ever get stolen.
In 'Membership Numbers' you can store various identification numbers that you receive after you join an organization or group.
Demo period and Registration
When you start Web Confidential for Palm for the first time you will see a demo notice. You can try Web Confidential for 30 days. After the demo period you will not be able to enter new passwords or HotSync with the desktop anymore. You will still be able to look at your data. After you register all functionality will be available.
To register tap the “Register...” button. Enter the registration key exactly as you received. Please note that the registration key depends on you HotSync user name. Make sure you supply the correct HotSync User Name when requesting a registration key. Also uppercase, lowercase and international characters are significant.
List View
When you start Web Confidential for Palm you see a list with your passwords.
- Use the scroll buttons to scroll your passwords.
- Tap a password's title to view or edit it.
- Tap the Note icon to edit the attached note in a full screen Memopad-like view.
- Tap the New button to create a new record.
- Tap the category popup to list the records in a specific category. We have already defined sensible categories for you, so you don't need to do that anymore.
- In the Look up field enter the beginning of a password to jump directly to it.
- Encrypt your database by selecting the “Encrypt...” item from the Encryption menu or tap the Lock button.
Encryption
Before you can encrypt your database, you should enter a passphrase. In the list view select “Change Passphrase...” from the Encryption menu. If you want to HotSync with your desktop, you should use the same passphrase as for your desktop password file. You can enter the passphrase with Graffiti or tap the keyboard icon to enter it using the onboard keyboard. Check the “Hide passphrase” to show the characters entered with an asterisk. Note that some input alternatives like Fitaly Stamp are not compatible with the Hide-option. Keep the “Hide passphrase” unchecked if you use such an program.
Close your database by selecting “Encrypt...” from the Encryption menu or tap the lock icon. You can now switch to another application, your database will stay encrypted. When you need to look up a record, launch Web Confidential for Palm, tap the padlock icon and enter your passphrase.
Whether your database is open or closed you can always switch to another application. When you launch Web Confidential for Palm again, it will check if the database is closed or open. If it is open it will show your records/passwords. If it is closed you can enter your passphrase to open the database or switch to another application, leaving your data encrypted.
To view your passwords tap the padlock button and enter your passphrase. When you start the application or powerup your device with the passwords locked the passphrase dialog will automatically popup.
Preferences Dialog
The Preferences menu item in Options menu allows you to change the preferences.
- Select the “Auto Lock” checkbox to automatically lock your passwords after a timeout. With the popup menu you can determine the timeout.
- Set the “At Exit and Power Off” option to immediately lock your passwords when you switch to another application or power off your device. See the section on HotSync to use this option with the HotSync Conduit.
- If you select the “Lock after HotSync” checkbox your passwords will be encrypted after a HotSync.
- The “Hide Password Field” checkbox allows you to enable or disable hiding of the password field in the Edit View. If this option is enabled, you have to tap the password field to view or edit it. To hide it again tap any other field.
Edit View
In the Edit View you can edit your records. All your records have five fields. The field names depend on the type of record.
- Tap the field you want to change to edit it. You can also jump to the next or previous field with the Next/Previous Field Graffiti strokes.
- The fourth field, which contains a password or account number, will be hidden to prevent people looking over your shoulders seeing it. To view or edit the password, tap the field. To hide it again tap any other field. You can disable this feature in the Preferences dialog.
- To change the record's category tap the category selector and select the category from the popup list.
- When you’re finished editing or viewing your record tap the Done button. You return to the record list.
- Tap the Details button to show the details dialog. You can delete the record, change it's category or mark it private. Go to the Security application to hide private records. Note that private records are just hidden, not encrypted. To encrypt your database, including the private records, select the “Encrypt...” item from the Encryption menu in the list view or tap the Lock button.
- You can copy the password field to the clipboard by tapping the Copy Key button. You can then paste it in another record or another application.
- To edit the note field in a full screen view tap the Note button.
- If the text is too large to fit in a field tap the Expand icon to popup a dialog in which you can edit it. If the text is too large for the expand dialog scroll your text with the scroll bar.
- To beam the current record select “Beam Password…” from the Record menu. The receiving device should have Web Confidential installed.
- Tap the Shortcut button to quickly insert frequently used text.
- Tap the Color button to change the color of the password as shown in the List view. Note that you can choose a color which is not well visible in the list. Just change it back to another color.
- Select “Generate Password…” from the Record menu to generate a random password. You can determine the length of the password and which type of characters to use.
Note View
You can edit a note attached to a password record by either tapping the Note icon in the List view or Edit view. You will be presented by a screen similar to the MemoPad view.
When your finished editing tap the “Done” button. You will return to the previous view.
You can delete the note by tapping the “Delete” button.
Left Handed Support
Web Confidential for Palm OS supports left handed users.
To enable this you need to install Lefty. This allows you to set a global preference setting declaring that you hold the stylus in your left hand. Web Confidential will note this setting, and adjust the interface layout accordingly.
You can download Lefty from:
<http://www.strout.net/pilotsoft/lefty/intro.shtml>
To HotSync a Web Confidential database you need Palm Desktop 3.0 or higher. You can download Palm Desktop from the Palm Web Site:
<http://www.palm.com>
The Conduit requires Web Confidential for Windows version 2.1 or higher. If you are still using an older version, please download the new version and convert your file to the new Web Confidential file format.
For HotSync to work, your password file on the desktop should be encrypted. The database on the Palm should have a passphrase defined, use the same passphrase as for your desktop password file. The database on your handheld should not be encrypted when you start HotSync.
The name and location of your password file is fixed and cannot be changed (at the moment). Its file name is “My Passwords”. If your HotSync name is, for example, “Palmaro”, the location of Palmaro’s password file is:
C:/Palm/Palmar/Confidential/My Passwords
Note that the user directory is not always exactly the same as the user name.
When you will do your first HotSync, you will need to decide to either write your Palm database of passwords to the PC, or your PC password file to the Palm database. To configure the Conduit, launch the HotSync manager (part of Palm Desktop) and choose “Custom…” from the popup menu. You will see this dialog:
Select the Web Confidential entry and press the “Change…” button. You will see the dialog shown on the next page.
- To write your Palm database to the PC, select the setting:
After the HotSync, a new password file, named “My Passwords”, has been created in the directory
Palm/Palmar/Confidential
- To write your PC passwords file to the Palm, you will first have to rename your current password file to “My Passwords” and then place it in the directory
Palm/Palmar/Confidential
Now select the setting:
“Desktop overwrites Handheld”.
- On the Palm start Web Confidential by tapping on the Confidential icon in the Application Launcher.
- Tap the menu silk button and from the Encryption menu and select “Change Passphrase...”. Enter the same passphrase as used for the desktop file. To HotSync the Web Confidential database on your handheld should not be encrypted. If you have set the preference “Auto Lock At Exit and Power Off” unlock your passwords, put the device into the cradle and press the HotSync button on the cradle.
- Put the Palm device in the cradle and push the HotSync button. Your Web Confidential password file will be installed on the Palm.
After installation of your password file the Conduit will automatically change its settings back to “Synchronize the files”.
Palm Desktop 4.2.1
If you change a record on your handheld or your desktop it will be synchronized at the next HotSync. Note that if you changed a record on both the desktop and your handheld you will end up with two records after a HotSync because the HotSync manager in that case can never know which data you want to preserve.
To sync more than one device each device must use its own “My Passwords” desktop file.
HotSync with Mac OS X
To HotSync a Web Confidential database you need a Macintosh with Palm Desktop 4.0 or higher. We recommend Palm Desktop 4.2.1, which can be downloaded from the Palm Web Site:
<http://www.palm.com>
The Conduit requires Web Confidential for Mac OS version 2.2 or higher. If you are still using an older version, please download the new version and convert your file to the new Web Confidential file format.
<http://www.web-confidential.com/notes37.html>
For HotSync to work, your password file on the Macintosh should be encrypted. The database on the Palm should have a passphrase defined, use the same passphrase as for your Macintosh password file. The database on your handheld should not be encrypted when you start HotSync.
To install your desktop data on the Palm, do the following:
- Use the Confidential Installer to copy the Confidential Conduit to the right place on your hard disk.
- Start Palm Desktop and the HotSync menu select “Conduit Settings ...”.
- Double click on “Confidential”.
- Select “Macintosh overwrites Handheld”.
- Click the Set button and select your Web Confidential password file. The Web Confidential password file should be encrypted.
- On the Palm start Web Confidential by tapping on the Confidential icon in the Application Launcher.
- Tap the menu silk button and from the Encryption menu and select “Change Passphrase...”. Enter the same passphrase as used for the desktop file. To HotSync the Web Confidential database on your handheld should not be encrypted. If you have set the preference “Auto Lock At Exit and Power Off” unlock your passwords, put the device into the cradle and press the HotSync button on the cradle.
- Put the Palm device in the cradle and push the HotSync button. Your Web Confidential password file will be installed on the Palm.
Palm Desktop 4.2 Windows 10
After installation of your password file the Conduit will automatically change its settings back to “Synchronize”.If you change a record on your handheld or your desktop it will be synchronized at the next HotSync. Note that if you changed a record on both the desktop and your handheld you will end up with two records after a HotSync because the HotSync manager in that case can never know which data you want to preserve.
You can sync more than one device to the same desktop file. Select the same file in the Conduit settings of both devices. To transfer the passwords from device 1 to device 2 HotSync the first device. Set the Conduit settings of the second handheld to “Macintosh overwrites Handheld” and HotSync.
Web Confidential and BackupBuddyNG
A previous version of Web Confidential had an incompatibility with the Mac OS version BackupBuddyNG. This has been solved in Web Confidential for Palm OS version 1.2 and later. If you use BackupBuddyNG please make sure that in Web Confidential for Palm OS the preference “Autolock After a HotSync” is set. Then the Confidential Conduit will encrypt your passwords before BackupBuddyNG will make a backup. If you don’t use the COnfidential Conduit please make sure that your passwords are encrypted before doing a HotSync. You can use the preference “Autolock At Exit and Power Off” to do this automatically.
Questions & Answers
Q In the Conduit Settings I can’t select my Macintosh file.
A Make sure your password file is upgraded to Web Confidential 2.2 or later and that it is encrypted.
Q In the Conduit Settings I can’t select my Windows file.
A Make sure your password file is upgraded to Web Confidential for Windows 2.1 or later and that it is encrypted.
Q I have set the Conduit Settings correctly, but still my desktop data is not synchronized to the handheld.
A Enter the passphrase in the Palm application (menu “Encryption/Change Passphrase...”). Use the same passphrase as for your desktop file. If you have set the preference “Auto Lock At Exit and Power Off”, unlock your passwords, put the device into the cradle and press the HotSync button on the cradle.
Q It doesn’t work.
A Make sure you have told the Conduit where you Macintosh password file is located. Open the Conduit Settings dialog in the HotSync Manager and specify the location of your password file with the “Set...” button. The Windows version will sync with a fixed file. See the section “HotSync with Windows version” above for more details
Q In the HotSync log there is the message “Unexpected file format version number.” or “This is not a Web Confidential file format.”
A The problem is with the desktop file. You need to upgrade it to at desktop version 2.2 or later for Macintosh or version 2.1 or later for Windows .
- Open your file in the latest desktop version of Web Confidential.
- Make a small change like adding a record.
- Save your file.
Q It still doesn’t work.
A Please check the HotSync log. For the Mac click the Palm icon at the right side of the menubar and select “HotSync/View Log..”. For Windows click the HotSync Manager icon in the lower right and select “View Log...”. Send the log message to: <>
Q Why should the Palm database be unencrypted when doing a HotSync?
A Because interruption of the HotSync process to allow you to enter your passphrase, would conflict with Palm’s concept of HotSync.
Q Web Confidential for Mac has reorganized the categories. Is there any easy way to transfer multiple entries from one category to another?
A The Password Manager category is now called Miscellaneous. Some passwords to log onto a Web Site should now be put into the category Web Forms. There is an easy way to change the category. First put all your data on the Palm. On the Palm it is very easy to change the category via the category pop up menu. Tap a card in the list view. When the card is in the edit view and you tap the category pop up menu, the category is changed. Now HotSync!
Q I get a message that the passphrase should be at least than eight characters even though I have entered one of more that eight characters.
A If you use an input alternative like Fitaly Stamp keep the option “Hide passphrase” unchecked.
Q I have forgotten the passphrase. Can you decrypt my database?
A Sorry, without your passphrase nobody can access your data.
Q Will my database be backed up at HotSync?
A When during a HotSync your handheld database is unencrypted, the Conduit will synchronize with your desktop file. If it is encrypted, a backup of your handheld database will be put in the backup folder of your user folder. The clear text unencrypted database will never be put on your desktop computer.
Tip: The encrypted Palm database is in a file with a path like “C:PalmUserBackupWeb_Confidential_Database”. The exact path depends on your user name and where the Palm Desktop has been installed. Make a copy of the file in a secure place.
On the Macintosh the backup will be in a file with the name “Web Confidential Database.pdb” in your user folder inside the Palm Desktop folder. The exact path depends on your user name and where you have installed the Palm Desktop.
Q I cannot find the backup of my Palm passwords on the desktop.
A See also the tip above.
Usually the Palm Desktop will be installed at “C:Palm” but you might have chosen another place.
Your user directory depends on the HotSync name of the device but does not need to be exactly the same.
If you have cleared the option “Hide file extensions for known file types” in the “Folder Options” the backup file will have the pdb-extension. In this case the path is “C:PalmUserBackupWeb_Confidential_Database.pdb”.
Q What is the difference between Web Confidential and other Palm security applications?
A Web Confidential is the only product which has a Macintosh version, a Microsoft Windows version and a Palm OS version. The Palm version is supplied with a Conduit to synchronize the handheld data with your desktop file. So, if you use a PC at work, an iMac at home and a Palm on the road you can access your data everywhere. Also, Web Confidential uses Blowfish for encryption, which has no known weakness.
List View Menus
Edit View Menus
#