Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encryptr – Free, open-source password manager and e-wallet

encryptr.org

Post reply on HN
Print view View original

21–30 of 78 posts

Re: Encryptr – Free, open-source password manager and e-wallet

#21

Post by sarciszewski »

tptacek wrote: post #20
sarciszewski wrote: post #4

https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further…

There doesn't appear to be much crypto in this project; it's a small application built on SpiderOak's Crypton.io. I'm not a fan of Crypton, but it's not clownshoes crypto. Just to be clear to everyone on the thread: it's very unlikely that there's anything practical an attacker can do with the modulus bias in a situation like this.

> Just to be clear to everyone on the thread: it's very unlikely that there's anything practical an attacker can do with the modulus bias in a situation like this.

Correct. This was just the first thing I saw in a cursory glance through their app.js file.

I haven't reviewed Crypton.io and can't say whether I like it or not. What don't you like about it in particular?

Re: Encryptr – Free, open-source password manager and e-wallet

#23

Post by shuzchen »

verandaguy wrote: post #3

I'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet. On one hand they claim to be in league with SpiderOak (how, I'm not sure), which surfaced after the Snowden leaks as a zero-knowledge encrypted alternative to Dropbox/Google Drive. On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone…

I used to (as recent as a couple months back) work at SpiderOak. Encryptr is connected to SpiderOak in a couple ways. First, it's build on top of crypton (https://crypton.io/) which is a SpiderOak research project. Second, the dev (https://github.com/devgeeks) works for SpiderOak (see his github teams or https://spideroak.com/about/team-&-leadership). Encryptr was a side project of his that he started in his spare time (to mess around with crypton), though obviously SpiderOak is now interested in its success (since it's one of the first/only crypton projects live in the wild).

Some other notes: SpiderOak didn't surface after the Snowden leaks. It was around at the same time that dropbox started. However, the Snowden leaks did prompt a lot more interest in zero-knowledge cloud services, so if you mean "surface" as in "became more popular with the public" you're right on those lines.

Also, while I'm not sure if Encryptr has been audited or not, the Crypton project itself has been at least a couple of times. See https://crypton.io/docs/security/audits.html

Re: Encryptr – Free, open-source password manager and e-wallet

#24

Post by stonogo »

feld wrote: post #11
Nux wrote: post #7

"Cloud-based. Private." ... Right.

It's hard to trust a cloud-based password manager. Now, if they're doing the crypto all local and syncing between devices with a miniature version of SpiderOak that would be OK. This is basically what 1Password does -- local crypto and stored on Dropbox or iCloud. That's not worrying at all as long as the crypto -- completely managed locally -- is strong. But if they're using, say, SSL and an API with your credential…

It's not hard to trust a cloud-based password manager -- it's insane.

Re: Encryptr – Free, open-source password manager and e-wallet

#25

Post by dchest »

sarciszewski wrote: post #16
dchest wrote: post #15

Earlier quoted context omitted.

It encrypts locally and sends encrypted data to "the cloud".

That's a good model to adopt. It's also the "ubiquitous encryption" that has James Comey crying like a baby. I encourage more apps and services to adopt this model. Just, be careful when you do. Definitely open source your code, and definitely get it audited by a qualified team (e.g. NCC Group's crypto services).

I think SpiderOak commissioned an audit of the underlying framework, Crypton... (googled) yep: https://crypton.io/docs/security/audits.html

Re: Encryptr – Free, open-source password manager and e-wallet

#26

Post by shuzchen »

sarciszewski wrote: post #4

https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further…

Encryptr's security bits are likely all implemented in the crypton framework. If you search the repo for that function (randomString), you'll see that it's only used in one place: to propose a new password (https://github.com/devgeeks/Encryptr/search?utf8=%E2%9C%93&q...). While it'd be best to not have any bias at all, this low bias only assists people trying to brute force passwords created by encryptr.

Crypton itself has been audited a couple times by crypto persons, see https://crypton.io/docs/security/audits.html

(disclaimer: i used to work at spideroak, but neither on crypton nor encryptr. i still think they're all awesome though)

Re: Encryptr – Free, open-source password manager and e-wallet

#27

Post by sarciszewski »

dchest wrote: post #25
sarciszewski wrote: post #16

Earlier quoted context omitted.

That's a good model to adopt. It's also the "ubiquitous encryption" that has James Comey crying like a baby. I encourage more apps and services to adopt this model. Just, be careful when you do. Definitely open source your code, and definitely get it audited by a qualified team (e.g. NCC Group's crypto services).

I think SpiderOak commissioned an audit of the underlying framework, Crypton... (googled) yep: https://crypton.io/docs/security/audits.html

Yep, this was mentioned above, and by Least Authority too. They do great work.

Re: Encryptr – Free, open-source password manager and e-wallet

#28

Post by d0mine »

homakov wrote: post #10
sarciszewski wrote: post #8

Earlier quoted context omitted.

Nothing in principle; it's the % operator that can biased the output. Also, outside the scope of Cordova apps, Node.js uses OpenSSL rather than /dev/urandom for their crypto.getRandomBytes() implementation, so I don't really trust it in that context. ;)

% shouldn't decrease the entropy, modulo of random is still random.

To see the bias compare the last two pictures https://www.wakari.io/sharing/bundle/jfs/Test%20PRNG%20using...

From http://stackoverflow.com/questions/16829183/what-is-pseudo-r...

Re: Encryptr – Free, open-source password manager and e-wallet

#29

Post by hermanmerman »

Does it support self-hosting of the server part? If I could deploy it to one of my Digital Ocean servers easily, I could see it become my default (and last) password manager. I'm too small a fish for a hacker to actually hunt my own server, and even if they do... it's zero knowledge, so I think I'd be comfortable with that.

Side question: does it support sharing of secured notes and credentials? even to non-encryptr users?

Post reply on HN