Recent Posts
July 31, 2014 | By Peter Eckersley
Mitro Releases a New Free & Open Source Password Manager
Good security practices require us to use different passwords for most or all of the websites and services we interact with. For accounts of any significance, those also need to be strong passwords of one form or another. But if you combine those two requirements (one password per site, most or all passwords are strong) then remembering all of your passwords requires an inhuman display of memory. Of course, when we need to perform inhuman tasks, we use software. And in this case, we use password stores and generators of various sorts. There are a lot of options for password managers out there, but if like us you prefer all of your security-sensitive code to be free, auditable software, then the choices are more limited.
Today, the team from a password manager startup called Mitro will be joining Twitter. As part of the deal, Mitro will be releasing the source to its client and server code under the GPL. We're very pleased to see this happening, and will be advising the Mitro team on how best to turn their startup's code into a sustainable free/open source software project.
Mitro is distinctive amongst free/open source password managers in that it's architected around cloud storage. For security, the online password databases are encrypted with client-side keys derived from your master password. For availability, they are mirrored across three cloud storage providers. With this design (documented here), passwords can be synchronized across all of your computers and devices with minimal effort. They can also be shared across teams and organizations. For those reasons, we're excited about the possibility that Mitro may turn into a valuable piece of infrastructure for the community.
Mitro has committed to funding continued operations of its servers until at least the end of 2014. If their code proves to be secure and popular with the community, we will be advising them on how to create a sustainable home for that infrastructure.
Mitro is already quite a mature and usable system. You can try it today and if you like it, tell your friends.1
Hacking on Mitro
Mitro will succeed if it has an enthusiastic userbase and developer community. Aside from trying out the software, there are lots of things you can do to contribute:
Report any problems — there is a new bug tracker on github, so if you run into a bug or a web site that doesn’t work reliably, please let them know. You can also always tweet @MitroCo.
Review the code, fix bugs — Mitro is free and open source; if you know Javascript or Java, you can improve it. Mitro has had some professional security auditing in the past, but if you're a security researcher, extra eyes looking for and reporting vulnerabilities are valuable.
Contribute documentation — Mitro has some limited documentation on Github. The Mitro team would welcome any contributions to help others use it effectively.
Update, 2014-07-31: revised post to link to Mitro's announcement, and clarify that while the Mitro team is joining Twitter, Mitro itself will continue as an independent corporation.
------------------------------------------------------------------------
1. For the time being, we don't recommend using the Android variant of Mitro; the Android app is likely to be vulnerable to password theft by malicious apps because of security problems that follow inherently from its use of the Android clipboard. We are presently researching ways to work around this problem.
So now we see it's doubly stupid because the patent still stands even though it's passing premise has been invalidated.-Edvard (August 10, 2014, 04:44 PM)
I think you meant:take the money andmove onrun.-40hz (August 10, 2014, 11:48 AM)
-Renegade (August 10, 2014, 12:22 PM)
) brought this utterly tasteless one to my attention. (Go figure! 
) Definitely NFC and NSFW:I don't think that we'll ever have copyright that makes sense though. The edge cases just push too hard.-Renegade (August 10, 2014, 11:25 AM)
P.D. I am searching for guvernamental web pages about security....-Contro (August 10, 2014, 06:09 AM)
In the building trade, the problem is 'gentleman's agreements' all the time.-Fred Nerd (August 10, 2014, 09:54 AM)
It's all kind of silly. I doubt any court will extend IP legal protections to a non-human at this stage of the game.-40hz (August 08, 2014, 05:28 PM)
I don't think Wikimedia is trying to argue that the copyright belongs to the ape. I think the point of Wikimedia's argument is that the image is essentially in the public domain because the camera's owner doesn't own the copyright (as he didn't take the picture, or even supervise/direct the photograph in any way), and the photographer (the person/creature/thing that took the photo) is not a human, so the ape can't own the copyright either.-Deozaan (August 09, 2014, 09:08 AM)
And yes - I've been out of touch with modern Satanic death metal lately.-Renegade (August 09, 2014, 12:18 AM)
Please anybody know about such thing-ruskiem (August 09, 2014, 10:33 AM)
"Multi-terminal needs" can easily be solved with tmux.-Tuxman (August 09, 2014, 08:14 AM)
This isn't limited to *nix TE's I presume?-Ath (August 09, 2014, 04:27 AM)
I WISH I were going, does that count?-Edvard (August 08, 2014, 05:51 PM)
Thanks 40hz-Masonjar13 link=topic=38649.m :Thmbsup:sg361479#msg361479 date=1407537116
...we now have a generation of music fans acoustically weaned on 128k mp3s-Edvard (August 08, 2014, 05:31 PM)
I don't think I'm quite good enough myself for any of those companies, but someday.-Masonjar13 (August 08, 2014, 01:15 PM)
hmmm...is it me or did the world in general suddenly become more "active" the past couple of weeks?-superboyac (August 08, 2014, 04:42 PM)