Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Encryptr – Free, open-source password manager and e-wallet

encryptr.org

Post reply on HN
Print view View original

51–60 of 78 posts

Re: Encryptr – Free, open-source password manager and e-wallet

#51

Post by daviddahl »

lucasgonze wrote: post #34

UX wins - 1. Readable typography. 2. Clean and simple flows. 3. Dedicated forms for credit cards, passwords, and notes. UX shortcomings - 1. No way to tweak the password generator algorithm. This matters because different contexts need different things. EG mobile passwords should avoid special chars and be longer to tradeoff. 2. No way to search. In any reasonably long lived password file you will be unable to scroll…

Search is coming in the next release!

http://monosnap.com/image/npl8jAtBNPAHUJAws8x4p3s3iAw36S#

I already have it (as I am a contributor). Its just getting better

Re: Encryptr – Free, open-source password manager and e-wallet

#52

Post by daviddahl »

sarciszewski wrote: post #4

https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further…

This is using getRandomValues which is cryptographically secure. The account/login/privacy crypto is using SJCL and the entire app is a signed desktop or mobile application - (no remote code)

Re: Encryptr – Free, open-source password manager and e-wallet

#53

Post by daviddahl »

neoCrimeLabs wrote: post #33
hermanmerman wrote: post #29

Does it support self-hosting of the server part? If I could deploy it to one of my Digital Ocean servers easily, I could see it become my default (and last) password manager. I'm too small a fish for a hacker to actually hunt my own server, and even if they do... it's zero knowledge, so I think I'd be comfortable with that. Side question: does it support sharing of secured notes and credentials? even to non-encryptr…

> Does it support self-hosting...? This was my first question too. I checked the android app, and there was no obvious configuration option for a different server. It's open source, so at least in theory it's possible to modify it to your needs. Also side note: Was a little disappointed to not see this on f-droid's marketplace since it is open source and hosted on github. Need to get that changed. :-)

Yes!

Re: Encryptr – Free, open-source password manager and e-wallet

#54

Post by daviddahl »

vetrom wrote: post #40
hermanmerman wrote: post #29

Does it support self-hosting of the server part? If I could deploy it to one of my Digital Ocean servers easily, I could see it become my default (and last) password manager. I'm too small a fish for a hacker to actually hunt my own server, and even if they do... it's zero knowledge, so I think I'd be comfortable with that. Side question: does it support sharing of secured notes and credentials? even to non-encryptr…

In theory, sure. Crypton.io itself is available on github and you could build your own server. On the Encryptr app side, src/app.js uses window.crypton.host and _.port to specify the crypton endopint to connect to. I think the app store build of encryptr uses a crypton endopint at devgeeks.org. You could just use (apache) cordova to roll your own build of the android app with app.js set to point to your preferred sel…

Indeed, you can do this and we encourage it. We are also building a private "feed" application called "Kloak", which resembles Twitter but is private and "un-dataminable".

See: https://zk.gs/ZK/kloak.pdf

Re: Encryptr – Free, open-source password manager and e-wallet

#55

Post by daviddahl »

sarciszewski wrote: post #8
homakov wrote: post #6

Earlier quoted context omitted.

What's wrong with window.crypto.getRandomValues?

Nothing in principle; it's the % operator that can biased the output. Also, outside the scope of Cordova apps, Node.js uses OpenSSL rather than /dev/urandom for their crypto.getRandomBytes() implementation, so I don't really trust it in that context. ;)

Encryptr does not ue node.js crypto at all. Just Blink and Webkit's getRandomValues, which is secure

Re: Encryptr – Free, open-source password manager and e-wallet

#57

Post by devgeeks »

lucasgonze wrote: post #34

UX wins - 1. Readable typography. 2. Clean and simple flows. 3. Dedicated forms for credit cards, passwords, and notes. UX shortcomings - 1. No way to tweak the password generator algorithm. This matters because different contexts need different things. EG mobile passwords should avoid special chars and be longer to tradeoff. 2. No way to search. In any reasonably long lived password file you will be unable to scroll…

Also, both password gen configuration and (probably CSV) import/export are coming as soon as I can get them in there.

Re: Encryptr – Free, open-source password manager and e-wallet

#59

Post by devgeeks »

Ruud-v-A wrote: post #45
vetrom wrote: post #30

Earlier quoted context omitted.

How is StartCom as a cert provider ironic?

It is a rogue CA that does not revoke compromised certificates even when presented with a proof of such compromise, unless the customer pays a revocation fee. If the customer does not pay the fee, StartCom provides trust (which is what CAs do; they say “we guarantee to the best of our knowledge that this server is the server it claims to be”) for websites which are known (by StartCom) to be compromised, defeating the…

Yeah, I haven't been happy with them. Luckily it's just the "marketing site" that uses it, not the actual backend server.

Re: Encryptr – Free, open-source password manager and e-wallet

#60

Post by verandaguy »

sarciszewski wrote: post #19
verandaguy wrote: post #3

I'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet. On one hand they claim to be in league with SpiderOak (how, I'm not sure), which surfaced after the Snowden leaks as a zero-knowledge encrypted alternative to Dropbox/Google Drive. On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone…

> On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this. I can extend an offer to them on behalf of Paragon Initiative Enterprises and, if it's accepted, post our findings on HN at a later date.

That'd probably help them out hugely regardless of the results. I'd be interested in reading the findings if/when they're posted.
Post reply on HN