4 ms·

We're very excited to make this available to the community and welcome pull requests, bug reports, etc.. Pitch in on Github: https://github.com/mitro-co/mitro

by vijayp 12y ago

We're very excited to make this available to the community and welcome pull requests, bug reports, etc.. Pitch in on Github: https://github.com/mitro-co/mitro https://github.com/mitro-co/mitro

dannyr 12y ago
How do I get started if I want to build an Android app?
- evanj 12y ago
  The Android app is in the mitro-core/android/MitroApp directory, and should build with the Eclipse ADT. See: https://github.com/mitro-co/mitro/tree/master/mitro-core/android https://github.com/mitro-co/mitro/tree/master/mitro-core/and...
scrollaway 12y ago
Congratulations on the release guys. Would you mind talking about your strengths and weaknesses compared to KeepassX?
- timonel 12y ago
  For starters, maybe we should ask why Mitro is only using 128bit AES (stated in their PDF design doc)?
  - helper 12y ago
    Please see the answer by cryptographer Thomas Pornin on AES 128 vs 256: http://security.stackexchange.com/questions/14068/why-most-people-use-256-bit-encryption-instead-of-128-bit http://security.stackexchange.com/questions/14068/why-most-p...
  - AaronFriel 12y ago
    AES-256 is not the most secure variant of AES any longer, as it appears that variant with key extension improves certain types of attacks. One of those, called a related key attack, requires only 2^119 time against AES-256, and 2^172 time against AES-192. (Time against AES-128 is approximately 2^128, I'd wager about 2^126-127). This is a very particular kind of attack, however, and it doesn't necessarily mean other weaknesses will be exposed. Cryptographers, though, are a conservative sort by nature, and many feel more comfortable sticking with AES-128, which was part of the original Rijndael specification and what was designed most rigorously. AES-128 also seems to have had the fewest weaknesses developed against it. The fact that any attack succeeded in reducing AES-256 to below AES-128's security can give crypto folks pause. I think realistically they are all very safe and AES-128 is unlikely to be broken by anything within the next decade. After that? I wouldn't wager.
  - nightcracker 12y ago
    Because it's the most secure.
drvortex 12y ago
I liked the idea of a free and open-source password manager. It seems that Mitro has been around for nearly a year.[1]. It does not seem anywhere near as mature as Lastpass though. There are no additional features such as a credit card or notes store. Also, it seems buggy since I was only able to login once through the Chrome extension. I guess I will stick with Lastpass for now.
- dmacvicar 12y ago
  Main feature from Lastpass that I use and I would miss is Yubikey support (http://www.yubico.com/products/yubikey-hardware/yubikey/ http://www.yubico.com/products/yubikey-hardware/yubikey/)

by vijayp 12y ago

We're very excited to make this available to the community and welcome pull requests, bug reports, etc.. Pitch in on Github: https://github.com/mitro-co/mitro https://github.com/mitro-co/mitro

dannyr 12y ago

How do I get started if I want to build an Android app?

evanj 12y ago
The Android app is in the mitro-core/android/MitroApp directory, and should build with the Eclipse ADT. See: https://github.com/mitro-co/mitro/tree/master/mitro-core/android https://github.com/mitro-co/mitro/tree/master/mitro-core/and...

scrollaway 12y ago

Congratulations on the release guys. Would you mind talking about your strengths and weaknesses compared to KeepassX?

timonel 12y ago
For starters, maybe we should ask why Mitro is only using 128bit AES (stated in their PDF design doc)?
- helper 12y ago
  Please see the answer by cryptographer Thomas Pornin on AES 128 vs 256: http://security.stackexchange.com/questions/14068/why-most-people-use-256-bit-encryption-instead-of-128-bit http://security.stackexchange.com/questions/14068/why-most-p...
- AaronFriel 12y ago
  AES-256 is not the most secure variant of AES any longer, as it appears that variant with key extension improves certain types of attacks. One of those, called a related key attack, requires only 2^119 time against AES-256, and 2^172 time against AES-192. (Time against AES-128 is approximately 2^128, I'd wager about 2^126-127). This is a very particular kind of attack, however, and it doesn't necessarily mean other weaknesses will be exposed. Cryptographers, though, are a conservative sort by nature, and many feel more comfortable sticking with AES-128, which was part of the original Rijndael specification and what was designed most rigorously. AES-128 also seems to have had the fewest weaknesses developed against it. The fact that any attack succeeded in reducing AES-256 to below AES-128's security can give crypto folks pause. I think realistically they are all very safe and AES-128 is unlikely to be broken by anything within the next decade. After that? I wouldn't wager.
- nightcracker 12y ago
  Because it's the most secure.

drvortex 12y ago

I liked the idea of a free and open-source password manager. It seems that Mitro has been around for nearly a year.[1]. It does not seem anywhere near as mature as Lastpass though. There are no additional features such as a credit card or notes store. Also, it seems buggy since I was only able to login once through the Chrome extension. I guess I will stick with Lastpass for now.

dmacvicar 12y ago
Main feature from Lastpass that I use and I would miss is Yubikey support (http://www.yubico.com/products/yubikey-hardware/yubikey/ http://www.yubico.com/products/yubikey-hardware/yubikey/)