5 ms·
I received this by email shortly after installing Mitro: "Congratulations on adding your first secret to Mitro" This makes me a little uncomfortable. How do t
by jfchevrette 12y ago
I received this by email shortly after installing Mitro:
"Congratulations on adding your first secret to Mitro"
This makes me a little uncomfortable. How do they know? Why should they know?
Edit: I could not find those words in the github repo.
- lobster_johnson 12y agoSecrets are stored on Mitro's servers. Presumably -- hopefully -- the passwords themselves are encrypted. Edit: Ah, yes: Mitro is distinctive amongst free/open source password managers in that it's architected around cloud storage. For security, the online password databases are encrypted with client-side keys derived from your master password. For availability, they are mirrored across three cloud storage providers. With this design ... passwords can be synchronized across all of your computers and devices with minimal effort.
- jfchevrette 12y agoThis I understand very well. So presumably they sent the email only after I sent them the first "blob of gibberish" telling them I added _at least_ one entry to my password database. Presumably they don't know if and when or how may entries I have. In this case they only noticed the first time I sent in my encrypted database.
- vijayp 12y agoSecrets are stored as described in the design document; the server knows how many secrets there are, but nothing about them: https://github.com/mitro-co/mitro/blob/master/PasswordManagerDesign.pdf https://github.com/mitro-co/mitro/blob/master/PasswordManage...