mSecure’s Security Model - Secure by design
A strong security system should be transparent - we can openly share how we encrypt and store user data without compromising security. If our system allowed us to access your data, an attacker could eventually figure out how to do the same. That's why we designed mSecure so that even we, the creators, have no way to access your information.
Key Security Features
End-to-End Encryption:
Your data is encrypted before it ever leaves your device. Your encryption keys are protected by your Account Password, meaning only you can unlock your information.
Strong Encryption Standards:
mSecure employs AES-256-bit encryption with multiple layers of protection to safeguard your data both at rest and in transit.
Account Password:
Your Account Password isn't just for unlocking the app - it plays a critical role in encryption, ensuring only you can decrypt your data.
Account Key:
A randomly generated 46-character key is created locally on your device. This key is never stored on our servers, adding an extra layer of security.
TLS Encryption:
All communications between your device and mSecure servers are encrypted using TLS/SSL, protecting your data from interception.
Account Key as Two-Factor Authentication:
Security experts recommend using multiple authentication factors:
- Something you know (your password).
- Something you have (your Account Key).
The Account Key strengthens your encryption exponentially, and since it's never sent to us, it cannot be reset, intercepted, or bypassed.
Why mSecure is Different
People often ask: "If major companies get hacked, how is mSecure any different?"
The key difference is we never have access to your data. Most websites need access to your information - banks store your balance and transactions, and online retailers process your credit card details. With mSecure, we only store your encrypted data and provide you with a secure way to retrieve it - without ever knowing what it contains.
How Your Data Stays Secure
1. Account Creating and Encryption:
- When you sign up, mSecure generates a highly secure, random 46-character password (Account Key) on your device. This key is crucial for encrypting your information.
2. The Strength of a 46-Character Password:
A 46-character password makes brute-force attacks virtually impossible.
- Even a supercomputer processing 360 billion passwords per second would take approximately 1.5x10⁴⁹ years to crack one account.
- For context, the universe is only 13.8 billion years old!
- On average, a supercomputer would find a password in half that time, but the odds of it happening in the next billion years are astronomically low.
3. How mSecure Authenticates You:
- When you create an account os sign in for the first time, mSecure generates an Account Key and encrypts a known piece of text (e.g., a copyright notice).
- This encrypted text is stored in your mSecure account.
- The Account Key itself is never stored on our servers. Instead, it's encrypted with your Account Password and stored only on your device.
- To help with authentication, we send you an "mSecure Account QR Code" or "mSecure Authentication" email containing your encrypted Account Key.
4. Logging in on a New Device:
To set up mSecure on a new device:
- Sign in with your email and Account Password.
- Scan your QR code or manually enter the encrypted Account Key.
- mSecure downloads and decrypts the known encrypted text to verify your identity.
- After successful authentication, your encrypted data is synced and only decrypted locally on your device.
The Bottom Line
- Your data is never stored in a readable format outside of mSecure.
- Encryption and decryptions always happens locally on your device.
- Even we (mSecure's developers) cannot access your information.
- This zero-knowledge security model ensures that your sensitive data remains yours - and yours alone.
Did you find it helpful? Yes No