Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mitro Releases a New Free and Open Source Password Manager

eff.org

Post reply on HN
Print view View original

121–130 of 131 posts

Re: Mitro Releases a New Free and Open Source Password Manager

#121

Post by throwaway41597 »

gabriel34 wrote: post #120
arantius wrote: post #114

Earlier quoted context omitted.

My guess is they're using the standard approach for deriving an encryption key from a password: http://en.wikipedia.org/wiki/PBKDF2

Thanks for the clarification (and thanks to throwaway above as well), seems this is standard. Is there a salt in this implementation? Is it bruteforced the first time I open the database on a new device?

It says the encryption is done client-side so a salt would be public.

edit: they may be salting with the username or email address.

Re: Mitro Releases a New Free and Open Source Password Manager

#122

Post by dserodio »

JungleGymSam wrote: post #77

Hi. Looks very nice but why would I switch from LastPass? They don't know my passwords too. They also have multi-factor authentication. They also have add-ins for all browsers and mobile too.

Because it's open source, so it will be easier to audit, and probably because of the UI (Lastpass UI got a lot better in the latest releases, but still sucks).

Re: Mitro Releases a New Free and Open Source Password Manager

#123

Post by dserodio »

dguaraglia wrote: post #48
Sephr wrote: post #45

There's no method to reset Mitro, so if you're like me and Mitro ran into an error partway through importing your KeePass database, you won't be able to reset Mitro and try importing with a different method. Do I seriously have to click manage->delete secret thousands of times just to reset Mitro?

Not really, nobody is forcing you to delete everything manually. You can always implement the feature yourself! (Sorry, didn't meant to be that guy , but seriously don't know why people expect a clearly new piece of open source software to do everything they want.)

Apparently, it's just been open sourced but it's not a new project

Re: Mitro Releases a New Free and Open Source Password Manager

#124

Post by superchink »

com_kieffer wrote: post #104
wlesieutre wrote: post #43

I'm a 1password user, but I'll definitely be checking this out. Having recently switched to Windows, I'm liking it a lot less. To put it charitably, their Windows version is not quite as nice as the Mac and iOS releases. It's a sunk cost at this point, but owning 1password on 3 platforms is expensive . $70 for my laptop and desktop, and another $18 for my phone. But I bought into it because the Mac version is great a…

Check out dashlane : https://www.dashlane.com/ I've been using it for a while and Its much nicer that 1Password. It has desktop app, a browser extension as well as android and iOS apps.

I tried dashlane when it first came out. Pegged my CPU and uninstalled it immediately. I assume it's improved since then, but that was a major turn-off.

Re: Mitro Releases a New Free and Open Source Password Manager

#125

Post by layman »

Andrenid wrote: post #71
SideburnsOfDoom wrote: post #41

Earlier quoted context omitted.

Not keeping sensitive data in Dropbox.

Is there a "secure" way to get a KeePass file onto an iPhone if Dropbox isn't safe? I don't need realtime sync, I'm happy to manually copy it across when I make changes, just curious what the proper way to do it is, if not via Dropbox.

I'm in the same boat (KeePassX and Dropbox), but I have been thinking about a peer-to-peer sync option. I don't need it to sync on WAN, just LAN sync is probably good enough for me. If it syncs between my couple of laptops and my phone, that's good enough for me. I have to see if BitTorrent Sync helps me do this.

Re: Mitro Releases a New Free and Open Source Password Manager

#126

Post by JungleGymSam »

SideburnsOfDoom wrote: post #92
JungleGymSam wrote: post #79

As computer people we should move away from teaching people that a strong password is one that is made up of random numbers, letters, symbols, and is hard to remember. Instead, let's teach them to create much longer passwords that are nonsensical sentences. *You can't beat the carrot! OR Passwords? They're for Sundays.

> let's teach them to create much longer passwords that are nonsensical sentences. Doesn't matter; nobody is going to remember fifty different ones. I have more website logins that that. Password reuse is going to happen and it is bad. The only secure way is for each password to be made up of a unique long, generated string of "random numbers, letters, symbols" for maximum entropy and stored in a password manager. Th…

I did a really poor job of explaining myself. Really poor.

I meant the master password. Mitro's password strength meter uses guidelines which are becoming (are?) old. So let's just move away from that altogether (for passwords that people should remember) and doing something that makes it easy to use lots of characters.

Re: Mitro Releases a New Free and Open Source Password Manager

#127

Post by frakkingcylons »

jtheory wrote: post #95
frakkingcylons wrote: post #18

The secret sharing across teams works which is good (LastPass's organization features are broken), but saving secrets is very slow right now.

We use LastPass internally, specifically to share long random passwords among the people that need them. It's not been a flawless experience, but it works -- what are the problems you've seen?

We were unable to get LastPass to actually share passwords at all. Created a shared folder with some passwords, checked to see if a coworker could see it, and sometimes they could see it, but most of the times the folder wouldn't show up at all. Spent at least an hour just debugging why this was happening, but we kept getting totally inconsistent results.

I say this as a mostly satisfied LastPass (Personal) user.

Re: Mitro Releases a New Free and Open Source Password Manager

#128

Post by frakkingcylons »

pwman wrote: post #51
frakkingcylons wrote: post #18

The secret sharing across teams works which is good (LastPass's organization features are broken), but saving secrets is very slow right now.

How are LastPass' organization features broken? Over 7,500 companies are using them successfully. https://enterprise.lastpass.com/enterprise-administration-ba...

I'm sure a lot do, but when we tried to set it up this past Wednesday, we couldn't get it to actually share credentials. Perhaps we were using it wrong, but if we couldn't get it to just work in an hour, there's a fundamental problem with the product.

Re: Mitro Releases a New Free and Open Source Password Manager

#129

Post by kraymer »

k2enemy wrote: post #103
zellyn wrote: post #81

Earlier quoted context omitted.

Very nice, but: 1) one of the reasons I use a password store is to share passwords with my wife. I can't imagine her using this 2) iPhone? Android? 3) 1password's integration with the browser is very helpful: since I've been using a linux box as my day-to-day machine (where 1password doesn't have a native version), I've been using it significantly less, because it adds friction. On Mac OS, I would just auto-gen a hor…

You're absolutely right -- my setup comes with a lot of limitations. They are ones that I'm happy living with, but when family and friends ask for advice on passwords I point them to 1Password. Hopefully Mitro will become my new recommendation!

That is limitations I could live with, I'm interested to give it a go. Could you post the scripts on pastie/github by any chance to spare me some dev time? or my mail is in my profile

Re: Mitro Releases a New Free and Open Source Password Manager

#130

Post by jtheory »

frakkingcylons wrote: post #127
jtheory wrote: post #95

Earlier quoted context omitted.

We use LastPass internally, specifically to share long random passwords among the people that need them. It's not been a flawless experience, but it works -- what are the problems you've seen?

We were unable to get LastPass to actually share passwords at all. Created a shared folder with some passwords, checked to see if a coworker could see it, and sometimes they could see it, but most of the times the folder wouldn't show up at all. Spent at least an hour just debugging why this was happening, but we kept getting totally inconsistent results. I say this as a mostly satisfied LastPass (Personal) user.

Ah, right -- we've got some odd behavior there as well; newly-shared folders not showing up in particular.

I suspect there are bugs in how the (locally-cached) LastPass vault stays up to date, possibly coupled with a delay on the server side for updates to be propagated to all vaults.

Just from my experience working with encryption... I'll bet the sharing process is fiddly, and they have some unresolved flow problems. E.g., imagine a new folder share offer is encrypted and queued for the recipient's vault, and can't be merged in until the recipient next signs in... but depending on their browser plugin settings, they may only sign in once every few weeks. So the plugin pings for queued updates and can send up auth keys... but already we're getting into enough complexity that bugs would be likely.

(I don't actually know how their folder sharing functions, but deploying encryption where the server only occasionally has the keys can quickly make simple requirements turn into Rube Goldburg contraptions...).

In our case, the shared folders eventually showed up for everyone (we specifically tried signing out of LastPass and restarting browsers... though I don't think we quite nailed down an "always works" solution), and once the basic shared folders were set up, it was smoother sailing.

Post reply on HN