[deleted]
KeeWeb: Unofficial KeePass web and desktop client
21–30 of 125 posts
Re: KeeWeb: Unofficial KeePass web and desktop client
#22How does it handle multiple users/computers trying to write to a database on dropbox?
I don't know about this version, but keepassx creates a file in the same directory where the password kdb file is, and use it as a lock.
But, keep in mind that dropbox can delay updates to the server (could be hours if you are disconnected) with no warning to the user, which means that two different users could update the same file independently and create a conflict. For this reason, it isn't suitable as an enterprise solution.
Having said that I recommend dropbox as a poor man escrow, so that somebody you trust as easy access to all your passwords for banking, social network (keep your alt accounts somewhere else :-) ), servers' root, etc...
Re: KeeWeb: Unofficial KeePass web and desktop client
#23Looks awesome! I've been using 1password, are there any big advantages that KeePass has over it?
I'm not sure about "big", it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere, or trust some closed source blob running in the browser, etc. It has a XML format that enables things like this client to be created. 1password has the advantage of excellent platform integration on iOS, and various browser ext…
I use my own script to generate passwords. I don't store anything beyond a salt. The password is just a hash of the website name, the salt and a master password. Then I just copypaste the result. Simple is best.
Re: KeeWeb: Unofficial KeePass web and desktop client
#24This is awesome. People are obviously going to give you a hard time about security and your implementation of the important parts of the software, but that's the advantage of open source! Edit: I am a daily user of KeePassX and get really tired of the UI after a while so I will definitely be trying this out ASAP!
Which version of KeePassX are you using? The 2.0 seems better.
And if you use a Mac, have you tried MacPass?
Re: KeeWeb: Unofficial KeePass web and desktop client
#25I always get confused with KeePass, KeePass2 and KeePassX... I use KeePassX on OS X. Will I be able to use this one with my database file?
Try MacPass. It's great.
Re: KeeWeb: Unofficial KeePass web and desktop client
#26Earlier quoted context omitted.
I'm not sure about "big", it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere, or trust some closed source blob running in the browser, etc. It has a XML format that enables things like this client to be created. 1password has the advantage of excellent platform integration on iOS, and various browser ext…
> the advantage of keepass is that I don't need to upload my credentials anywhere But if you want to sync your credentials across devices, you still have to upload them somewhere, right? Doesn't this just support sync via Dropbox? If so, aren't you then just playing the trust game between two third-parties?
You are uploading a file that is encrypted using very strong encryption, not plain text password.
An employee of that company, or if the file was leaked due to technical errors, a member of the general public won't be able to decrypt it. If one of the richest governments wanted to, they might be able to, but if you had reasons to be a target you'd know better than using this.
Also, take a look at SpiderOak.
Re: KeeWeb: Unofficial KeePass web and desktop client
#27Check out pass for those wanting a solution in line with the Unix way:
Re: KeeWeb: Unofficial KeePass web and desktop client
#28Earlier quoted context omitted.
I'm not sure about "big", it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere, or trust some closed source blob running in the browser, etc. It has a XML format that enables things like this client to be created. 1password has the advantage of excellent platform integration on iOS, and various browser ext…
I use my own script to generate passwords. I don't store anything beyond a salt. The password is just a hash of the website name, the salt and a master password. Then I just copypaste the result. Simple is best.
Is there a name for this kind of scheme where you can generate a password every time because you have all the parts needed? I've been seeing that people do this but don't have a name for it.
Re: KeeWeb: Unofficial KeePass web and desktop client
#29Do not generate passwords with it, it uses insecure Math.random:
https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3...
https://github.com/antelle/keeweb/blob/master/app/scripts/ut...
(in meme form: https://imgur.com/FcZNflQ)
Filed issue: https://github.com/antelle/kdbxweb/issues/5
(embarrassing/funny: it was me who wrote Salsa20 "user-space" generator used here (https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3...), but it should be properly seeded from secure random number source to be secure. Added this note to the gist where the author found it: https://gist.github.com/dchest/4582374#file-salsa20-js-L1-L1...)
Re: KeeWeb: Unofficial KeePass web and desktop client
#30How does it handle multiple users/computers trying to write to a database on dropbox?
I don't know about this version, but keepassx creates a file in the same directory where the password kdb file is, and use it as a lock. But, keep in mind that dropbox can delay updates to the server (could be hours if you are disconnected) with no warning to the user, which means that two different users could update the same file independently and create a conflict. For this reason, it isn't suitable as an enterpri…
Yep, aware of how KeepassX does this. Its better than some (i.e. there are locks at all) but dropbox doesn't always cooperate. Have been looking for a better solution, but most seem to not even do the lock file thing.