Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Encryptr's security bits are likely all implemented in the crypton framework. If you search the repo for that function (randomString), you'll see that it's only used in one place: to propose a new password (https://github.com/devgeeks/Encryptr/search?utf8=%E2%9C%93&q...). While it'd be best to not have any bias at all, this low bias only assists people trying to brute force passwords created by encryptr.

Crypton itself has been audited a couple times by crypto persons, see https://crypton.io/docs/security/audits.html

(disclaimer: i used to work at spideroak, but neither on crypton nor encryptr. i still think they're all awesome though)



The contents of the second audit in particular deeply troubled me. Lots of simple but grevious mistakes. It's nice that they got the audit though.


FWIW, the audit happened directly in the middle of a dev cycle, without any of the normal internal review of that code first. The audit report describes those circumstances in the first few pages. Scheduling audits is hard work!


Yeah, especially when there are no clearly defined "sprints".




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: