Encryptr

Considering they had earlier tickets opened by their own team to fix it and hadn't, I'm calling "oversight". https://github.com/SpiderOak/Encryptr/issues/49 That being said, I do agree with your analysis that the impact of this isn't a problem for users.

Wow. While the bias was tiny, I expect more from crypto software. Calling it a "non-problem" is very strange. Edit: submitted another patch https://github.com/SpiderOak/Encryptr/pull/263

I lean towards "No". For example, this was never merged: https://github.com/SpiderOak/Encryptr/pull/180 I eventually closed it because I keep an eye on https://github.com/pulls and it was unnecessary clutter.

SpiderOak'er here; as a reminder, we also offer Encryptr, our own password manager: https://spideroak.com/solutions/encryptr Which itself _is_ open source: https://github.com/SpiderOak/Encryptr

Encryptr is interesting and looks very nice. Includes source: https://github.com/devgeeks/Encryptr But it doesn't appear to have anything like Lasspass's autofill on android that supports the fingerprint reader.

Does Encryptr support 2FA? I don't see any mention on the landing page or on Github. EDIT: After more digging, it looks like it does not, but may in the future. https://github.com/devgeeks/Encryptr/issues/123

This looks like very nice, lightweight interface, great work! Hopefully it will get browser support as per https://github.com/devgeeks/Encryptr/issues/169

Encryptr's security bits are likely all implemented in the crypton framework. If you search the repo for that function (randomString), you'll see that it's only used in one place: to propose a new password (https://github.com/devgeeks/Encryptr/search?utf8=%E2%9C%93&q...). While it'd be best to not have any bias at all, this low bias only assists people trying to brute force passwords created by encryptr. Crypton itself has been audited a couple times by crypto persons, see https://crypton.io/docs/security/audits.html (disclaimer: i used to work at spideroak, but neither on crypton nor encryptr. i still think they're all awesome though)

https://github.com/devgeeks/Encryptr/blob/64223f0cb4adba80c8... I'm a bit concerned that their random number generator might produce biased output. This is usually a red flag that there are other issues in the code that haven't been examined by a crypto person. Just a word of caution from a casual glance. For all I know the rest of the code is fine. For all I know, the rest of the code is clunky swiss cheese. Further reading on biased RNGs, with a visual: https://stackoverflow.com/a/31374501/2224584

The site seems to be down. Here's the repo: https://github.com/devgeeks/Encryptr

Looks interesting but 2 concerns: 1) On the releases (https://github.com/devgeeks/Encryptr/releases) it supports many platforms, but it seems to be only the client, being the server only offered as a cloud solution. It would be much more appealing if the source code of the server was also open source and you could host it on your own server 2) It claims to be zero-knowledge and suggests you to store your credit-card information and passwords there. Going back to point 1, if you could self-host it you could trust it more, but if you can't how can you know that it's not a very elaborate honey-pot to make the tin-foil crowd give up their most valuable secrets and data, including credit-card info and passwords?

SpiderOak [1] released (or rather "endorsed") an "open source, 'Zero-Knowledge', cloud-based password manager" called Encryptr [2] as well. [1] https://spideroak.com/ [2] https://github.com/devgeeks/Encryptr