PwM README
==========

(c)2003 Michael Buesch <mbuesch@freenet.de>
http://passwordmanager.sourceforge.net/
http://www.tuxsoft.de.vu


Did you ever forget a password? I did. :)
Then I started to search a good password-manager,
but I didn't find one, that fit my needings.
So I decided to write a new one from scratch.
So here is it.
Have fun with it.


Requirements:
-------------

KDE 3, QT 3, libbzip2, libz, libxml2.


Features: (incomplete list)
---------------------------

- PwM encrypts your passwords with strong blowfish
  encryption.
- It's able to import and export Gpasman, Kpasman
  and plain-text files.
- It's able to print password-lists.
- encrypt the list with a key-card (instead of a
  master-password).


Security note:
--------------
The encryption-algorithms, PwM uses, are said to be
unbreakable, these days. So if you select a good
masterpassword, nobody should be able to decrypt
the password-list without the password.

But there's another side, that I want to note, too.
A problem of _every_ password-managing and
password-handling software is information-leakage.
Let's explain that.
Given the situation, you loaded a password list,
this list has to be stored unencrypted somewhere
in memory. This is the first information-leakage
point. One second point for a security hole is the
swapping-behaviour of your operating system. If
the operating system pages out exactly this memory
page, the decrypted list is stored in, it is
written unencrypted to the harddisk and might
survive there for some time.
Third point is the printing feature of PwM. While
printing, the passwords are sent unencrypted to
the printing-system on your computer. The critical
point here is, how the printing system might
handle this information. It may or may not write
it tempoarly somewhere to the harddisk or somewhere
in memory, accessible by every user.

These security-notes are not here, to make you
thinking PwM is unsave. Just the opposite is true,
because these are all very theoretical information-
leakage points.
On normal systems, these points are most times
not relevant and can be ignored.
