Passwords and host keys

Password and 2FA prompts

These only ever appear in the viewer, including ones from jump hosts. Agents don’t see the prompt or what you type, and the answers aren’t saved in recordings.

If an agent opens a session to a host that asks for a password, the prompt waits in the viewer until you answer it.

The password vault

For hosts that only accept passwords, Tandem can remember them in an encrypted vault. It’s optional.

• Passwords are encrypted with AES-256-GCM, using a key derived from your master password with scrypt.
• Nothing is written to disk unencrypted, and the master password itself isn’t stored.
• You create, unlock and lock the vault under Vault in the viewer. Agents have no access to it.

While the vault is unlocked, saved passwords are filled in when you connect. When an agent opens the session, they’re only filled in for hosts where you’ve ticked allow agent auto-fill, which is off by default.

SSH keys or the OpenSSH agent are still the better choice where a host supports them.

Changed host keys

Tandem remembers a server’s host key the first time it connects. If the key is different next time, it won’t connect, since that’s what a machine-in-the-middle attack looks like.

If the server really was rebuilt or re-keyed, the viewer shows the old and new fingerprints next to each other. Check the new one some other way, then trust it and reconnect. Agents can’t do this step.

Next: Telnet