Using CERMM

Passwords

A shared vault for the team, encrypted in the browser. The server holds only sealed blobs and public keys.

Who can use it

People with the Passwords privilege (Admin and Technician have it). Losing the privilege or being suspended removes access. The vault needs HTTPS: it uses the browser's WebCrypto.

Starting the vault, and joining it

1. Each person sets a vault password of their own, separate from their sign-in password.
2. The first person starts the vault.
3. Anyone else sets their vault password and waits. Someone who already has access gives it to them, after comparing the key fingerprint that both their pages show.

Forgot the vault password

You get new keys, and someone with access gives it to you again. If nobody else has access, what's in the vault is lost. CERMM says so before you do it.

Entries

Login, device, Wi-Fi, API key, license, secure note. An entry has a title, username, password, address, two-factor secret, notes and a device.

• A password generator, and a strength meter.
• Weak, Reused and Over a year old point out passwords to change.
• TOTP codes from a stored two-factor secret.
• Folders, and a link to a device. That device's page has a Passwords section, with an unlock right there.

Guard rails

• Copying or showing a password is in the audit log.
• The clipboard is wiped after 30 seconds.
• The vault locks after 15 idle minutes, on Lock, on sign-out and on reload.

How it's encrypted

Your vault password seals your own ECDH P-256 private key (PBKDF2, 600,000 rounds). The team's AES-256 vault key is wrapped to each person's public key. Every entry is sealed with the vault key and bound to its ID, so an entry can't be moved onto another.