8 ms·
Encryptr – Free, open-source password manager and e-wallet
- Ruud-v-A 11y agoThe site is using a startcom certificate … how ironic.
- vetrom 11y agoHow is StartCom as a cert provider ironic?
- sarciszewski 11y agohttp://smbc-comics.com/index.php?db=comics&id=1823#comic http://smbc-comics.com/index.php?db=comics&id=1823#comic
- Ruud-v-A 11y agoIt is a rogue CA that does not revoke compromised certificates even when presented with a proof of such compromise, unless the customer pays a revocation fee. If the customer does not pay the fee, StartCom provides trust (which is what CAs do; they say “we guarantee to the best of our knowledge that this server is the server it claims to be”) for websites which are known (by StartCom) to be compromised, defeating the purpose of having CAs in the first place. After Heartbleed many certificates had to be revoked, and one person who did not want to pay the revocation fee had the idea of publishing his private key so that the certificate was compromised without doubt. StartCom refused to revoke it, and the page that explained the story has since disappeared mysteriously. The HN thread about it is here: https://news.ycombinator.com/item?id=7577290 https://news.ycombinator.com/item?id=7577290
- sarciszewski 11y agoSorry, accidentally downvoted. Meant to upvote.
- devgeeks 11y agoYeah, I haven't been happy with them. Luckily it's just the "marketing site" that uses it, not the actual backend server.
- egeozcan 11y agoThe site seems to be down. Here's the repo: https://github.com/devgeeks/Encryptr https://github.com/devgeeks/Encryptr
- verandaguy 11y agoI'm cautiously optimistic about this, but won't be using it to manage passwords for anything important -- yet. On one hand they claim to be in league with SpiderOak (how, I'm not sure), which surfaced after the Snowden leaks as a zero-knowledge encrypted alternative to Dropbox/Google Drive. On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this. Hoping for the best for Encryptr, but I'll have to keep it on the sidelines until it's more battle-tested.
- shuzchen 11y agoI used to (as recent as a couple months back) work at SpiderOak. Encryptr is connected to SpiderOak in a couple ways. First, it's build on top of crypton (https://crypton.io/ https://crypton.io/) which is a SpiderOak research project. Second, the dev (https://github.com/devgeeks https://github.com/devgeeks) works for SpiderOak (see his github teams or https://spideroak.com/about/team-&-leadership https://spideroak.com/about/team-&-leadership). Encryptr was a side project of his that he started in his spare time (to mess around with crypton), though obviously SpiderOak is now interested in its success (since it's one of the first/only crypton projects live in the wild). Some other notes: SpiderOak didn't surface after the Snowden leaks. It was around at the same time that dropbox started. However, the Snowden leaks did prompt a lot more interest in zero-knowledge cloud services, so if you mean "surface" as in "became more popular with the public" you're right on those lines. Also, while I'm not sure if Encryptr has been audited or not, the Crypton project itself has been at least a couple of times. See https://crypton.io/docs/security/audits.html https://crypton.io/docs/security/audits.html
- feld 11y agolooks like at least one of the devs works on the SpiderOak team according to github membership
- sarciszewski 11y ago> On the other hand, it's a cloud-based solution which to me is still a cause for caution, and I'd feel more reassured if someone (who knows JavaScript and security better than I do) conducted an audit of this. I can extend an offer to them on behalf of Paragon Initiative Enterprises and, if it's accepted, post our findings on HN at a later date.
- sarciszewski 11y agohttps://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8d89f23762bba0c8dc7fa3c/src/app.js#L285-L298 https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further reading on biased RNGs, with a visual: https://stackoverflow.com/a/31374501/2224584 https://stackoverflow.com/a/31374501/2224584
- tptacek 11y agoThere doesn't appear to be much crypto in this project; it's a small application built on SpiderOak's Crypton.io. I'm not a fan of Crypton, but it's not clownshoes crypto. Just to be clear to everyone on the thread: it's very unlikely that there's anything practical an attacker can do with the modulus bias in a situation like this.
- sarciszewski 11y ago> Just to be clear to everyone on the thread: it's very unlikely that there's anything practical an attacker can do with the modulus bias in a situation like this. Correct. This was just the first thing I saw in a cursory glance through their app.js file. I haven't reviewed Crypton.io and can't say whether I like it or not. What don't you like about it in particular?
- gingerlime 11y ago> I'm not a fan of Crypton Just curious - is this to do with using javascript crypto[0]? or something that goes beyond that? [0] https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/ https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
- sarciszewski 11y agoJavaScript is only a real issue when you have an insecure code delivery mechanism. The article spells that out pretty well.
- homakov 11y agoThis is cool, will install it right now. Shameless plug: I work in the same field but instead of storing passwords trying to replace passwords and 2fa altogether with one scheme working as a web app: truefactor.io/app
- tmd83 11y agoHow does it work? Any info on that.
- homakov 11y agoNothing new, private keys are generated per account, the entire app will be in appcache, and sync is done via simple API and encrypted with your passphrase messages (same as crypton - zero knowledge). From the start you get 2 private keys both stored in your browser on truefactor.io/app. Later if you you decide to "2factorize" some website it can done with 1 click. To log in you need two signatures so you have to click "approve" on both devices with a private key. The integration flow for consumer websites is also very simple: 1 tiny JS lib and 10-20 lines of code on the server side to verify 2 signatures against public keys of the user. Out of box fixes passwords reuse, phishing, bruteforce, 2factorization, enforceable, open and free etc
- Nux 11y ago"Cloud-based. Private." ... Right.
- feld 11y agoIt's hard to trust a cloud-based password manager. Now, if they're doing the crypto all local and syncing between devices with a miniature version of SpiderOak that would be OK. This is basically what 1Password does -- local crypto and stored on Dropbox or iCloud. That's not worrying at all as long as the crypto -- completely managed locally -- is strong. But if they're using, say, SSL and an API with your credentials to access the encrypted cloud storage and they have the key... this is bad.
- stonogo 11y agoIt's not hard to trust a cloud-based password manager -- it's insane.
- dchest 11y agoIt encrypts locally and sends encrypted data to "the cloud".
- sarciszewski 11y agoThat's a good model to adopt. It's also the "ubiquitous encryption" that has James Comey crying like a baby. I encourage more apps and services to adopt this model. Just, be careful when you do. Definitely open source your code, and definitely get it audited by a qualified team (e.g. NCC Group's crypto services).
- dchest 11y agoI think SpiderOak commissioned an audit of the underlying framework, Crypton... (googled) yep: https://crypton.io/docs/security/audits.html https://crypton.io/docs/security/audits.html
- 11y ago
- hermanmerman 11y agoDoes it support self-hosting of the server part? If I could deploy it to one of my Digital Ocean servers easily, I could see it become my default (and last) password manager. I'm too small a fish for a hacker to actually hunt my own server, and even if they do... it's zero knowledge, so I think I'd be comfortable with that. Side question: does it support sharing of secured notes and credentials? even to non-encryptr users?
- neoCrimeLabs 11y ago> Does it support self-hosting...? This was my first question too. I checked the android app, and there was no obvious configuration option for a different server. It's open source, so at least in theory it's possible to modify it to your needs. Also side note: Was a little disappointed to not see this on f-droid's marketplace since it is open source and hosted on github. Need to get that changed. :-)
- daviddahl 11y agoYes!
- vetrom 11y agoIn theory, sure. Crypton.io itself is available on github and you could build your own server. On the Encryptr app side, src/app.js uses window.crypton.host and _.port to specify the crypton endopint to connect to. I think the app store build of encryptr uses a crypton endopint at devgeeks.org. You could just use (apache) cordova to roll your own build of the android app with app.js set to point to your preferred self-hosted endpoint. YMMV. Note: this is definitely a product at the MVP stage. The platform is capable of implementing data sharing, but that is not currently used by the Encryptr application.
- daviddahl 11y agoIndeed, you can do this and we encourage it. We are also building a private "feed" application called "Kloak", which resembles Twitter but is private and "un-dataminable". See: https://zk.gs/ZK/kloak.pdf https://zk.gs/ZK/kloak.pdf
- dbmikus 11y agoI like this for my password manager: http://www.passwordstore.org/ http://www.passwordstore.org/ It's all UNIX based and takes advantage of GPG and Git for encryption and versioning, respectively. Super lightweight, and there are various front-ends for it, including an Android app. It's not a cloud-based solution by default, but it wouldn't be hard to set it up to git push to a central location on each update and to pull from that location down to all your end-points.
- ymse 11y agoIt also supports multiple identities, so passwords can have different recipients. Good if you don't want to share everything with your phone. The best part is that the program itself is a ~500 line shell script: https://github.com/zx2c4/password-store/blob/master/src/password-store.sh https://github.com/zx2c4/password-store/blob/master/src/pass...
- cmrx64 11y agoI dislike pass because it doesn't encrypt all information in the typical configuration. Its simplicity is nice.
- lucasgonze 11y agoUX wins - 1. Readable typography. 2. Clean and simple flows. 3. Dedicated forms for credit cards, passwords, and notes. UX shortcomings - 1. No way to tweak the password generator algorithm. This matters because different contexts need different things. EG mobile passwords should avoid special chars and be longer to tradeoff. 2. No way to search. In any reasonably long lived password file you will be unable to scroll through quickly enough. 3. No importer(s) for legacy password manager files.
- daviddahl 11y agoSearch is coming in the next release! http://monosnap.com/image/npl8jAtBNPAHUJAws8x4p3s3iAw36S# http://monosnap.com/image/npl8jAtBNPAHUJAws8x4p3s3iAw36S# I already have it (as I am a contributor). Its just getting better
- devgeeks 11y agoAlso, both password gen configuration and (probably CSV) import/export are coming as soon as I can get them in there.
- vanous 11y agoThis looks like very nice, lightweight interface, great work! Hopefully it will get browser support as per https://github.com/devgeeks/Encryptr/issues/169 https://github.com/devgeeks/Encryptr/issues/169
- bitskits 11y agoDoes Encryptr support 2FA? I don't see any mention on the landing page or on Github. EDIT: After more digging, it looks like it does not, but may in the future. https://github.com/devgeeks/Encryptr/issues/123 https://github.com/devgeeks/Encryptr/issues/123
- systemz 11y agoCloud based and private? It's not how this works.
- msh 11y agoStrange that there are no iOS client.
- devgeeks 11y agoWarning: long answer ahead. Short version: there will be very soon. I use it daily on my own iPhone. The issue is that because Crypton does crypto with JavaScript in the web view of a Cordova app, it needs to not be stupendously slow. The default iOS web view available for Cordova apps, up until iOS 8, was the UIWebView which is well known for not having access to a JIT (like Nitro in mobile Safari). This means that JavaScript crypto (particularly done the way SJCL does it) is VERY slow. We're talking almost two minutes just to log in. :/ However, even though iOS 8 now provides a web view with a JIT (WKWebView), it has been slightly crippled by Apple. The WKWebView disallows loading local files except from the app's tmp folder. This has meant some work for the Cordova iOS team to get the WKWebView working. It is finally at a stage where it can be used, but some of the changes Cordova had to make to get it working, plus some differences in WKWebView's API, mean some changes had to be made to both Crypton and Encryptr to get it all to work. It's working now. However, since I will still have to dance through a few more hoops of fire (Apple submission and other pain), I am planning on pushing out a new version for the existing platforms first. Then I should be able to do what needs to be done to get the iOS version out.
- msh 11y agoSounds great :) If you need a beta tester please mail me (martindk at mailbox.org)
- wjyagainyc 11y agoWhy don't everyone use Firefox sync, it is also zero-knowledge? I am not provoking, just curious.
- deleted 11y ago[deleted]
- newscracker 11y agoTwo suggestions for the web page. First, please include the system requirements for each platform under the platform names. That would make it easier to decide whether to download the application or not. Second, a nitpick - the OS on Mac computers is called "OS X" since the time of OS X 10.7 Lion and not "Mac OS X". Please fix that. The name "Mac OS X" was used only for older releases up to Mac OS X 10.6 Snow Leopard. :)