Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mitro Releases a New Free and Open Source Password Manager

eff.org

Post reply on HN
Print view View original

111–120 of 131 posts

Re: Mitro Releases a New Free and Open Source Password Manager

#111

Post by mikestew »

heinrich5991 wrote: post #102
mikestew wrote: post #62

Earlier quoted context omitted.

If you stay within the Apple ecosystem, 1Password is great. If you stray outside of that bubble, not so great. Their Android app sucks (quit putting an icon in my system bar every time I open the app, for starters), and the Windows version isn't so hot, either. Yeah, it's pricey, but in the end I think it's worth the aggravation and time it saves me.

I heard that you have to do this in order to not get killed when inactive.

That's the annoying part. I'm not privy to the internal workings, but I just need the app to fire up and stick something on the clipboard. After that, let the OS kill you off because I'll fire you back up again ad hoc.

The notification says it's synchronizing with my chosen cloud provider, maybe it doesn't want to get inadvertently killed during that process. Okay, fair enough. But can't the notification be removed after it's done? (An honest, if rhetorical question; don't know enough about Android to say for sure.) I have enough special snowflake apps sticking their crap in the notification bar, one less would be nice.

Re: Mitro Releases a New Free and Open Source Password Manager

#112

Post by throwaway41597 »

gabriel34 wrote: post #110

I'm no crypto or security expert, but this worries me: "For security, the online password databases are encrypted with client-side keys derived from your master password" What is going on here? Does it hash my master password, generating a new pass? If so, this seems like it would only increase the number of bits in the possible keyspace but not increase the number of possible keys, while actually lowering security (…

I'm no expert but I see no harm here. In order to use symmetric encryption, you need a certain key size (e.g. 128-bit key for AES-128). How do you transform a password of, say, 15 characters to 128 bits? You guessed it, with a hash (well a key derivation function to slow down brute force). What they do is I think standard practice.

> but not increase the number of possible keys

So yes, if your password is weak, then it won't make it strong.

> while actually lowering security (since hash collisions can occur)

But I think you're wrong here. On a human password of 30 bits of entropy, there is very little chance of collision. If one collision was to happen, you'd still have a key space of (30^2) - 1, which is very much the same number.

Re: Mitro Releases a New Free and Open Source Password Manager

#113

Post by jtheory »

SideburnsOfDoom wrote: post #101
jtheory wrote: post #96

Earlier quoted context omitted.

The KeePass database is strongly-encrypted before you put it up on Dropbox, so you're not relying on Dropbox's own encryption (I wouldn't either).

I refer you to the techdirt article linked above. If you upload a KeePass file to dropbox now, you may be vulnerable to a way of cracking keepass files available at some future date .

Yup; but I'd say you're letting the perfect be the enemy of the pretty damned good.

KeePass' encryption is quite solid -- if it starts to show some cracks in the face of quantum computers or whatnot somewhere in the future, I can always upgrade and change my passwords so the old database isn't valuable any more.

That'd be a PITA, but I don't expect this to happen -- nor for the govt to come up with a huge vulnerability that no one else sees -- so that's the kind of bet I'm comfortable taking.

Re: Mitro Releases a New Free and Open Source Password Manager

#114

Post by arantius »

gabriel34 wrote: post #110

I'm no crypto or security expert, but this worries me: "For security, the online password databases are encrypted with client-side keys derived from your master password" What is going on here? Does it hash my master password, generating a new pass? If so, this seems like it would only increase the number of bits in the possible keyspace but not increase the number of possible keys, while actually lowering security (…

My guess is they're using the standard approach for deriving an encryption key from a password: http://en.wikipedia.org/wiki/PBKDF2

Re: Mitro Releases a New Free and Open Source Password Manager

#115

Post by fooqux »

reedlaw wrote: post #93
zellyn wrote: post #81

Earlier quoted context omitted.

Very nice, but: 1) one of the reasons I use a password store is to share passwords with my wife. I can't imagine her using this 2) iPhone? Android? 3) 1password's integration with the browser is very helpful: since I've been using a linux box as my day-to-day machine (where 1password doesn't have a native version), I've been using it significantly less, because it adds friction. On Mac OS, I would just auto-gen a hor…

I'd love to find a way to securely share passwords with mobile devices. But from what I understand, there's no very secure way to do it on Android. If you store a private key on the device then other applications may have access to it. And with iOS, each app is its own silo, so I'm not sure how you'd get password autocomplete working. An ideal solution would allow selective sharing because there are some secrets you…

>Android

It depends on how you do it. If you use the local app storage, it's protected via the OS. Only the App itself can read/write from it.

If you use "USB Storage" then the data is stored on the sd card or equivalent. Any other app with the USB Storage permission can read or write to that directory and it's very much not secured.

As for interfacing with other apps to "autocomplete" your password, there are permissions and ways to do that too, although I can't speak for them since I've never done it.

Re: Mitro Releases a New Free and Open Source Password Manager

#116

Post by Spooky23 »

Just use KeePassX.

Cost is zero, available on all platforms that you care about, and it's a stable format. What more do you want?

Cleartext cloud storage is a no-no. Browser integration from my POV is really dangerous as well... trying to keep secrets using the most widely attacked platform out there sounds like an exercise in futility.

Re: Mitro Releases a New Free and Open Source Password Manager

#117

Post by Spooky23 »

rsanek wrote: post #61
mstachowiak wrote: post #56

"Good security practices require us to use different passwords for most or all of the websites .... remembering all of your passwords requires an inhuman display of memory." It actually is possible to create unique passwords for every website and remember them without inhuman displays of memory. To do so, there are two basic things you need to remember: 1) A unique base password 2) A simple hashing function The input…

I used this form for a while but realized that if someone is doing a targeted attack specifically on you and happens to find a single compromised password of yours, all the others are only a few guesses away. It's better than re-using passwords, but still worse than using truly unique ones.

If you're being specifically targeted, the key is accessing your email.

Re: Mitro Releases a New Free and Open Source Password Manager

#118

Post by Nullabillity »

vincentkriek wrote: post #90
dnfehren wrote: post #16

Since the company has been acquired what are the plans for the service? http://labs.mitro.co/ says that "The service will continue to operate as-is for the foreseeable future." but there is a lot of ambiguity in 'forseeable.' While I really appreciate the value of having the client and server code open sourced I don't want to run my own server nor do I want to sign up for a service that, with the changes that will li…

The best thing would be if they would release the server software. That way you could run the software yourself and be totally independent. If that happens, I'm totally on board. Now I'm still on the fence between this and LastPass

That was part of the announcement.

Re: Mitro Releases a New Free and Open Source Password Manager

#119

Post by 1amzave »

gioele wrote: post #82
k2enemy wrote: post #69

I'll use this as an opportunity to give a shout out for my new favorite password manager: pass [0] It uses gpg to encrypt passwords that are then stored locally, but can be synced using Dropbox, rsync, unison, etc. It is a command line program, so it doesn't have things like browser integration, but on a mac, a little Automator magic alleviates most of that pain. Besides, after trying 1password, lastpass, and a few o…

I'll use this as an opportunity to give a shout out for my own unix password manager that I started writing because I did not like some design choices of pass: pw [1]. From the homepage: > pw is an alternative to pass, keepassx and other similar programs. > The main points of pw are: > * The passwords are stored using a simple line-based text format. > * Passwords can be protected using public-key encryption or symme…

That looks neat -- I've been using a somewhat similar little home-baked thing of my own (simple shell script wrapping gpg), largely because I wanted a simple command-line password manager and this 'pass' thing I've been seeing linked in various places strikes me as (a) pretty poorly designed and (b) quite over-sold -- e.g. its author declaring it "standard" when it's clearly nothing of the sort is rather off-putting. There've been patches posted on the xmonad development mailing list recently adding support for it, but I'm really hoping they don't get integrated because I don't view encouraging increased use of it as a good thing.

Re: Mitro Releases a New Free and Open Source Password Manager

#120

Post by gabriel34 »

arantius wrote: post #114
gabriel34 wrote: post #110

I'm no crypto or security expert, but this worries me: "For security, the online password databases are encrypted with client-side keys derived from your master password" What is going on here? Does it hash my master password, generating a new pass? If so, this seems like it would only increase the number of bits in the possible keyspace but not increase the number of possible keys, while actually lowering security (…

My guess is they're using the standard approach for deriving an encryption key from a password: http://en.wikipedia.org/wiki/PBKDF2

Thanks for the clarification (and thanks to throwaway above as well), seems this is standard. Is there a salt in this implementation? Is it bruteforced the first time I open the database on a new device?
Post reply on HN