Encryptr – Free, open-source password manager and e-wallet
1–10 of 78 posts
Re: Encryptr – Free, open-source password manager and e-wallet
#2The site seems to be down. Here's the repo: https://github.com/devgeeks/Encryptr
Re: Encryptr – Free, open-source password manager and e-wallet
#3I'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet.
On one hand they claim to be in league with SpiderOak (how, I'm not sure), which surfaced after the Snowden leaks as a zero-knowledge encrypted alternative to Dropbox/Google Drive.
On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this.
Hoping for the best for Encryptr, but I'll have to keep it on the sidelines until it's more battle-tested.
Re: Encryptr – Free, open-source password manager and e-wallet
#4https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8...
I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person.
Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese.
Further reading on biased RNGs, with a visual: https://stackoverflow.com/a/31374501/2224584
Re: Encryptr – Free, open-source password manager and e-wallet
#5This is cool, will install it right now. Shameless plug: I work in the same field but instead of storing passwords trying to replace passwords and 2fa altogether with one scheme working as a web app: truefactor.io/app
Re: Encryptr – Free, open-source password manager and e-wallet
#6https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further…
What's wrong with window.crypto.getRandomValues?
Re: Encryptr – Free, open-source password manager and e-wallet
#7"Cloud-based. Private." ... Right.
Re: Encryptr – Free, open-source password manager and e-wallet
#8https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further…
What's wrong with window.crypto.getRandomValues?
Nothing in principle; it's the % operator that can biased the output.
Also, outside the scope of Cordova apps, Node.js uses OpenSSL rather than /dev/urandom for their crypto.getRandomBytes() implementation, so I don't really trust it in that context. ;)
Re: Encryptr – Free, open-source password manager and e-wallet
#9I'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet. On one hand they claim to be in league with SpiderOak (how, I'm not sure), which surfaced after the Snowden leaks as a zero-knowledge encrypted alternative to Dropbox/Google Drive. On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone…
looks like at least one of the devs works on the SpiderOak team according to github membership
Re: Encryptr – Free, open-source password manager and e-wallet
#10Earlier quoted context omitted.
What's wrong with window.crypto.getRandomValues?
Nothing in principle; it's the % operator that can biased the output. Also, outside the scope of Cordova apps, Node.js uses OpenSSL rather than /dev/urandom for their crypto.getRandomBytes() implementation, so I don't really trust it in that context. ;)
% shouldn't decrease the entropy, modulo of random is still random.