Source
r/tutanota•
808error

Store Password

Hi. If I select the Store Password option in your app then where will my password be stored? In the app itself or somewhere outside?

Posted Aug 16, 2018, 3:08 AM UTC

25
Gaspacchio•

The password is stored on your device, not on Tutanota's servers :)

1
808errorOP•

Is it safe to use this option? I use a phone that runs a custom ROM (no root) with no Google Play Service. Entering my lengthy password every time is a hassle.

1
Gaspacchio•

Based on "Innovative encryption" from Tutanota's blog, we can guess that storing the password on your phone is probably secure because it seems not to be stored in plain-text but instead as the “password verifier".

Thus, we can then read:

The password verifier is cryptographically independent from the password key so that the password verifier can not be used to decrypt any data. The password verifier is transmitted to the Tutanota server secured with TLS encryption.

But this is not totally clear, as the app is never mentioned, nor the terms "storing the password"...

1
808errorOP•

Thank you. I wasn't aware of this password verifier.

1
Gaspacchio•

Maybe there is more in this statement:

Tutanota’s session handling also enables you to close sessions remotely. When you lose your mobile phone and you are still logged in with the Tutanota app, you can close this session from any other device. By closing the session remotely, you make sure that no one can access your secure emails on the lost phone.

So, if you loose your phone, you may close your session remotely, at any time.

1