Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mitro Releases a New Free and Open Source Password Manager

eff.org

Post reply on HN
Print view View original

61–70 of 131 posts

Re: Mitro Releases a New Free and Open Source Password Manager

#61

Post by rsanek »

mstachowiak wrote: post #56

"Good security practices require us to use different passwords for most or all of the websites .... remembering all of your passwords requires an inhuman display of memory." It actually is possible to create unique passwords for every website and remember them without inhuman displays of memory. To do so, there are two basic things you need to remember: 1) A unique base password 2) A simple hashing function The input…

I used this form for a while but realized that if someone is doing a targeted attack specifically on you and happens to find a single compromised password of yours, all the others are only a few guesses away. It's better than re-using passwords, but still worse than using truly unique ones.

Re: Mitro Releases a New Free and Open Source Password Manager

#62

Post by mikestew »

wlesieutre wrote: post #43

I'm a 1password user, but I'll definitely be checking this out. Having recently switched to Windows, I'm liking it a lot less. To put it charitably, their Windows version is not quite as nice as the Mac and iOS releases. It's a sunk cost at this point, but owning 1password on 3 platforms is expensive . $70 for my laptop and desktop, and another $18 for my phone. But I bought into it because the Mac version is great a…

If you stay within the Apple ecosystem, 1Password is great. If you stray outside of that bubble, not so great. Their Android app sucks (quit putting an icon in my system bar every time I open the app, for starters), and the Windows version isn't so hot, either.

Yeah, it's pricey, but in the end I think it's worth the aggravation and time it saves me.

Re: Mitro Releases a New Free and Open Source Password Manager

#63

Post by AaronFriel »

timonel wrote: post #28
scrollaway wrote: post #14

Earlier quoted context omitted.

Congratulations on the release guys. Would you mind talking about your strengths and weaknesses compared to KeepassX?

For starters, maybe we should ask why Mitro is only using 128­bit AES (stated in their PDF design doc)?

AES-256 is not the most secure variant of AES any longer, as it appears that variant with key extension improves certain types of attacks. One of those, called a related key attack, requires only 2^119 time against AES-256, and 2^172 time against AES-192. (Time against AES-128 is approximately 2^128, I'd wager about 2^126-127).

This is a very particular kind of attack, however, and it doesn't necessarily mean other weaknesses will be exposed. Cryptographers, though, are a conservative sort by nature, and many feel more comfortable sticking with AES-128, which was part of the original Rijndael specification and what was designed most rigorously. AES-128 also seems to have had the fewest weaknesses developed against it. The fact that any attack succeeded in reducing AES-256 to below AES-128's security can give crypto folks pause.

I think realistically they are all very safe and AES-128 is unlikely to be broken by anything within the next decade. After that? I wouldn't wager.

Re: Mitro Releases a New Free and Open Source Password Manager

#64

Post by guiambros »

cheshire137 wrote: post #46
wlesieutre wrote: post #43

I'm a 1password user, but I'll definitely be checking this out. Having recently switched to Windows, I'm liking it a lot less. To put it charitably, their Windows version is not quite as nice as the Mac and iOS releases. It's a sunk cost at this point, but owning 1password on 3 platforms is expensive . $70 for my laptop and desktop, and another $18 for my phone. But I bought into it because the Mac version is great a…

Yeah, I get the feeling they don't care about their Windows users at all. I just try to ignore the Windows desktop app because at least the Chrome extension is fine in Windows.

There's a v4 beta for Windows, which is very similar to the Mac version. Better than the stable v3.

I'm using it on Linux (under Wine) and works well. The Chrome extension is a lot better.

Re: Mitro Releases a New Free and Open Source Password Manager

#65

Post by SideburnsOfDoom »

andrey-p wrote: post #44
SideburnsOfDoom wrote: post #41

Earlier quoted context omitted.

Not keeping sensitive data in Dropbox.

Even if it's encrypted?

http://www.theguardian.com/technology/2014/jul/17/edward-sno...

https://www.techdirt.com/articles/20130620/15390323549/nsa-h...

Re: Mitro Releases a New Free and Open Source Password Manager

#66

Post by SideburnsOfDoom »

hackcasual wrote: post #47
SideburnsOfDoom wrote: post #42

Storing my passwords in the cloud means it's already got one mark against it. What does it do to make make for that?

Presumably encrypting them with a password you control?

It's still an avoidable risk. And one that can be applied retroactively.

https://www.techdirt.com/articles/20130620/15390323549/nsa-h...

Re: Mitro Releases a New Free and Open Source Password Manager

#67

Post by elithrar »

guiambros wrote: post #64
cheshire137 wrote: post #46

Earlier quoted context omitted.

Yeah, I get the feeling they don't care about their Windows users at all. I just try to ignore the Windows desktop app because at least the Chrome extension is fine in Windows.

There's a v4 beta for Windows, which is very similar to the Mac version. Better than the stable v3. I'm using it on Linux (under Wine) and works well. The Chrome extension is a lot better.

> There's a v4 beta for Windows, which is very similar to the Mac version. Better than the stable v3.

Agreed. The v4 Windows client is much, much better than the old v3 - and finally allows you to use the same Chrome extension. I previously had to run two versions of the extension (and all the frustration that brings) if I wanted to use 1Password on my Windows installs.

Re: Mitro Releases a New Free and Open Source Password Manager

#68

Post by [deleted] »

dguaraglia wrote: post #48
Sephr wrote: post #45

There's no method to reset Mitro, so if you're like me and Mitro ran into an error partway through importing your KeePass database, you won't be able to reset Mitro and try importing with a different method. Do I seriously have to click manage->delete secret thousands of times just to reset Mitro?

Not really, nobody is forcing you to delete everything manually. You can always implement the feature yourself! (Sorry, didn't meant to be that guy , but seriously don't know why people expect a clearly new piece of open source software to do everything they want.)

[deleted]

Re: Mitro Releases a New Free and Open Source Password Manager

#69

Post by k2enemy »

I'll use this as an opportunity to give a shout out for my new favorite password manager: pass [0]

It uses gpg to encrypt passwords that are then stored locally, but can be synced using Dropbox, rsync, unison, etc. It is a command line program, so it doesn't have things like browser integration, but on a mac, a little Automator magic alleviates most of that pain. Besides, after trying 1password, lastpass, and a few others, the browser integration was usually a source of frustration instead of convenience.

For my setup, I have a keyboard combo mapped to an Automator action that gets the current URL from Safari, passes it to a shell script that strips out the hostname, then uses pass to copy the password to the clipboard for 45 seconds. Then, I use another script to have a notification pop up with my username in case I've forgotten it. So I press "cmd+\", then a second later I have my password in the clipboard and my username showing on a temporary desktop notification.

I'm also using pass to store bank credentials, software keys, and other things. I also have it set up to use a different gpg key to keep a journal. It has turned out to be a very versatile and reliable piece of software.

[0] http://www.passwordstore.org

Post reply on HN