Security

Maximum Output Software is committed to data security and privacy.  As such, MOS Authenticator keeps your secret keys safe.  It is not a cloud-based application, and none of your data is ever sent anywhere over the Internet in any form -- plain text, encrypted, or even hashed -- by the software. 

However, we also wanted to keep your data safe locally.  So your secret keys are stored using AES-256 encryption with encryption passphrases of more more than 1024 bits (hashed using SHA-256).  The passphrases are unique for each Windows user account as well, so even if someone gains access to your computer your secret keys will not be compromised - they would have to be able to log into your Windows account to access your data.

To make it more difficult to "sniff" secret keys from MOS Authenticator's memory, the keys are stored in memory in their AES-encrypted form, and are only decrypted long enough to calculate each authentication code, after which both the decrypted data and decryption key are securely destroyed until the next time they are needed.  We won't go so far as to say it is impossible for someone to grab your secret keys, but it would be difficult.

The down side of this level of security is that if your change your Windows account username, MOS Authenticator will be unable to retrieve/use your saved secret keys, and all sites must be removed and re-added.

MOS Authenticator and the Internet

MOS Authenticator will run just fine without an Internet connection as long as your system clock is accurate.  Because authentication codes are time-based, your computer must have an accurate clock.  If you are connected to the Internet when Authenticator is launched, it will synchronize its internal clock with Maximum Output Software to help guarantee that authentication codes are correct.  The clock synchronization request is encrypted, is only used for adjusting the clock, is completely anonymous, and does not contain any user data.

Bottom line, MOS Authenticator is safe and protects your privacy.

Note for Windows XP Users

MOS Authenticator uses the Windows Crypto API for encryption of user data.  The Crypto API on Windows XP does not support the SHA-256 hash algorithm that we use to generate encryption keys on newer versions of Windows.  Rather than not allow MOS Authenticator to run on Windows XP, the hash algorithm used to derive the encryption key on XP is dropped back to SHA-1 instead of SHA-256.  The encryption algorithm itself used is still AES-256, but the hash used to derive the key is slightly less secure than the hash used on newer versions of Windows, resulting in slightly less theoretical (though in practical terms, no less) data security.