Versatile Monkey Wiki - New pages [en]

HoneyDew Premium

Marwatk — Sat, 05 Mar 2011 01:30:58 GMT

Marwatk: Created page with 'The premium version of HoneyDew is almost identical to the free version, with the following exceptions. The premium version supports device-side encryption (AES-256, see the [Se…'

The premium version of HoneyDew is almost identical to the free version, with the following exceptions.

The premium version supports device-side encryption (AES-256, see the [Security Page|HoneyDew Security] for details

The premium version doesn't show ads

The premium version will eventually support push notifications

The premium version helps support HoneyDew development! :)

HoneyDew Security

Marwatk — Sat, 12 Feb 2011 22:58:21 GMT

Marwatk:

== How Secure is HoneyDew? ==

=== Password Security ===

This gets very technical very fast, you've been warned.

Your password is never stored in plain text anywhere. Ever. The progress bar you see when you first log in is the device performing [http://en.wikipedia.org/wiki/PBKDF2 PBKDF2] hashing of your password using [http://en.wikipedia.org/wiki/HMAC HMAC]/[http://en.wikipedia.org/wiki/SHA-1 SHA-1], with your email address as the salt. This is actually done twice. The result of the first set of PBKDF2 is used as your 'password' stored on the device. This will also be the basis of your encryption key if using encrypted mode (premium feature). This key is then run through PBKDF2 again, and this will be your 'server' password. The result of the second PBKDF2 is the only password related item that will ever leave the device. Both of the PBKDF2 results are stored on the device.

=== Device Security ===

Any obfuscation of the data stored on the device is pointless without a password required to access HoneyDew every time. I don't want to do this for a number of reasons ([http://en.wikipedia.org/wiki/Wife_acceptance_factor WAF is the largest]), so HoneyDew relies on you to properly configure your device to be secure. I realize this is not always possible for every device, but hopefully it soon will be. (Yay device encryption in Honeycomb)

=== Server Security ===

As soon as the server gets your 'server password' from the device, it's again PBKDF2'd this time using a random salt from a properly seeded SecureRandom in java. This is what's stored in the DB and verified when the device sends it over. The server doesn't ever do the actual work of syncing, that's left to the devices, which enabled the server to never need to see the data. This allows for true device-side encryption. Note that this is a premium feature only, and not enabled by default even then. The reason is that if you forget your password and your DB is encrypted, it's gone. No one that can recover it if you used a decent password. This is a support issue for most HoneyDew users. If you don't have encryption enabled, then you're relying on me knowing how to properly secure a server and database. I think I'm decent. <Fingers crossed>

=== Database encryption ===

If you have DB encryption enabled, the result of the first set of PBKDF2 is used as your encryption key for 256-bit [http://en.wikipedia.org/wiki/Advanced_Encryption_Standard AES] encryption using a random salt and following the OpenSSL algorithm for encryption. The encryption is directly equivalent to this Linux command line option:

<code>
[marwatk@bigguy ~]# echo -n 'Hello World!' | openssl enc -a -e -salt -aes256 -pass pass:foo

U2FsdGVkX1/uTCW4DNk1KVINSTKoEHuZruLnU+cHJ6k=

[marwatk@bigguy ~]# echo 'U2FsdGVkX1/uTCW4DNk1KVINSTKoEHuZruLnU+cHJ6k=' | openssl enc -a -d -salt -aes256 -pass pass:foo

Hello World!
</code>

Substituting the output of the PBKDF2 for the password. I don't pretend to know whether this is secure, but I do assume that the openssl guys know what they're doing, which is why I went this route.

HoneyDew Basic Usage

Marwatk — Sat, 12 Feb 2011 22:15:13 GMT

Marwatk:

= Basic HoneyDew Usage =

== What is HoneyDew? ==

HoneyDew is a dead-simple ([http://en.wikipedia.org/wiki/Wife_acceptance_factor high WAF]) cross-platform synchronized todo list.

== Creating an Account ==
[[File:android_create.png|thumb|Creating an Account]]
When you first start HoneyDew you'll see the login screen. You'll need to create an account. Click 'Create an Account'. This will simply add a 'confirm password' field. Now enter your email address and a password. You'll need to enter the same email/password combo on all devices you'll be syncing with. Then click 'Create Account'. For more details, see [[HoneyDew Login Screen#Creating_an_Account|Creating an Account]] in the Login Screen Help.

== Logging in on Other Devices ==

After you've created an account on one device, the other devices just need to log in. Simply enter the email and password you used in the previous step and click the 'Log in' button (not pictured).

== Enter List Items ==
{|
| [[File:android_add.png|thumb|none|Android Add Screen]]
| [[File:android_add_2.png|thumb|none|Android Auto-Text on Add Screen]]
| [[File:bb_add.png|thumb|none|BlackBerry Add Screen]]
|}

After logging in, you'll be taken to either an [[HoneyDew List Screen|empty list]] or the [[HoneyDew Add Screen|add screen]]. On Android you can click the tabs at the top to switch between the screens. On BlackBerry you can use either the 'back' key to get to the list from adding, or use the menu to add items when viewing the list.

Here you'll enter items on your list. Enter the item first. If you've previously used this item, it will appear in the drop down. Clicking it will pre-fill the category. If it's a new item, hit enter to move to the category field and start typing the category. As you type the category, any matching existing categories will appear in the drop down. You can click one or finish typing to create a new one. You can simply press enter after the category to add an item, it's not necessary to use the menu or the 'Add Item' button. Keep adding items until you're done.

== Viewing your List ==
{|
| [[File:android_list.png|thumb|none|Android List Screen]]
| [[File:bb_list.png|thumb|none|BlackBerry List Screen]]
|}

When you go shopping, or otherwise want to remove items, you'll use the [[HoneyDew List Screen|list screen]]. Click categories to expand them, then the 'X' to delete them on Android. On BlackBerry simply highlight an item and use the 'Del' button on your keyboard if present, or click them on touch screen devices.

== That's it ==

Really. HoneyDew will manage the complex syncing behind the scenes, you needn't worry about it. There are details you can get familiar with, such as [[HoneyDew Premium|upgrading to HoneyDew premium to remove ads]], [[HoneyDew Import/Export|importing and exporting]], [[HoneyDew Cleanup|deleting old items from the drop downs]], [[HoneyDew Settings|configuring update intervals]], and [[HoneyDew Security|the nuts and bolts of HoneyDew's security]], but if you don't want to, you don't have to.

== Is there something I can make better or easier? ==

Keep in mind: the goal of HoneyDew is simplicity and flexibility. But, if there's something I can add or change to make it even more flexible while keeping it simple or to make it even more simple, drop me a line. You can use the 'Help' menu item in HoneyDew to visit my forums or send me an email. Happy HoneyDewing!

HoneyDew Login Screen

Marwatk — Sat, 12 Feb 2011 21:29:10 GMT

Marwatk:

= HoneyDew Login Screen =

[[File:android_login.png|thumb|Android Login Screen]]

'''Wondering why HoneyDew is asking you to log in? [[HoneyDew New Version|Click here]]'''

This is the first screen you'll see when starting HoneyDew for the first time. If you haven't created an account yet, you'll need to do that first.

== Creating an Account ==

Click the 'Create an Account' button. This will add a 'Confirm Password' entry box. Now just enter your email address and a password. Note that the email password combination you choose will need to be shared with all devices you choose to sync with, so choose a password you're comfortable sharing with those you'll be linked to. It is safe, though, to enter the password for them on the device, it cannot be recovered once successfully logged in.

[[File:android_create.png|thumb|Creating an Account]]

After entering your email and password, click 'Create Account' again. If all goes to plan you'll be taken to the [[HoneyDew Add Screen|add items]] or [[HoneyDew List Screen|list]] screen and you can start [[HoneyDew Basic Usage|using HoneyDew]]

'''Notes about creating an account:'''
*Your email address is *only* used for password resets/changes and will never be sold or rented for any other purpose. In fact, if you don't care about resetting your password, you don't have to enter your real email address. (Just don't lose your password and make sure you pick a good one from the start)
*You'll need to enter the same email/password combination on all devices you'll be syncing with
*Once entered on a device, your password cannot be read again (it is never reversibly stored.) You're safe using a password that you don't want the device owner to know as long as you enter it yourself and make sure the login is successful

== Logging in ==

If you've previously created an account, you can simply log in. Enter the email and password you used to create the account and you're all set to [[HoneyDew Basic Usage|use HoneyDew]].

== Forgotten Password ==

If you forget your password or want to change it you can click the 'Forgot Password' button on this screen, or the 'Change Password' button from the [[HoneyDew Settings|Settings Screen]]. Because the HoneyDew server [[HoneyDew Security|never sees your password]], changing it requires two steps. In step one HoneyDew will send an email to the address you use to log in. This email will contain a code that can be used only once and only for 30 minutes to change your password. Once you receive this email and code, go back to HoneyDew and click 'Forgot password' or 'Change Password' again. This time a new set of boxes will appear asking you to enter the code, and a new password (twice). Once complete your password will be changed, and devices with the old password will revert to the login screen the next time they are started. You'll need to enter the new password on every device.

'''Notes about changing your password:'''
*If you have encryption enabled, changing your password will prevent access to your server-side data. There are no exceptions, and not even the NSA could get it back ([[HoneyDew Security|unless you used a weak password]].) If you still have a copy of the data on your device (which is not encrypted, by design), you'll simply push a new encrypted copy and all will be well. If you don't, there's no way to get it back.
*If you don't use your reset code within 30 minutes, simply request a new one

== Working Locally ==

If you don't want to sync with other users, you can bypass the login altogether by choosing 'Work Locally'. Note that this setting is not retained, and is generally only for when the password has been changed and you're not aware of the new password yet. Changes to the local list will not be replicated to the server until you've successfully logged in.

HoneyDew New Version

Marwatk — Sat, 12 Feb 2011 20:48:40 GMT

Marwatk:

== What has happened? Why is HoneyDew now asking me to log in? ==

HoneyDew has changed! Now you can sync between BlackBerry and Android, and soon iPhone and web clients! And it's free to use! Though you can pay a small ($0.25/month) fee to get HoneyDew 'premium' which removes ads and allows end to end encryption. (Previous paid HoneyDew users will get a free year of HoneyDew 'premium' if they use the same email address as they used to purchase.)

Because there's no way for BlackBerries to talk directly to Androids and vice versa, it's necessary to have a intermediary. That's where the new HoneyDew comes in. It uses a backend server to facilitate the communication. That takes infrastructure, which takes money, hence the new fee/ad structure.

The first time you load the new HoneyDew you'll be asked to log in. You can create an account for free, simple click the 'Create Account' button. Enter your email (to get a free year of HoneyDew 'premium' as a past HoneyDew user enter the email you used to purchase the old HoneyDew), and choose a password. Note that you'll need to enter this same email and password on all devices you'd like to sync with, so don't use a password you don't want your sync partners to know.

After that, click 'Create Account' again and you're all set. HoneyDew will work almost exactly as it did before, except now you can sync with more than 2 devices (as many as you want, actually), and you can sync with different device types.

Why do I say 'almost'? The new version will no longer instantly notify you of changes that sync partners make. It's periodically checking in the background, but it won't be instant. (Though it does check every time you run HoneyDew itself, so if you have cell-service where you shop it won't matter much). I'm working on instant notifications, but it's likely going to be a paid-version-only feature.

== I hate this, where's the old version? ==

The old version of HoneyDew is still available for those that previously purchased. You can download it here:

http://ota.versatilemonkey.com/honeydew_classic/

This will still work for completely peer-to-peer BlackBerry syncing for those that have previously purchased, but I won't be selling new registration codes for that version.