Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeeWeb: Unofficial KeePass web and desktop client

github.com

Post reply on HN
Print view View original

31–40 of 125 posts

Re: KeeWeb: Unofficial KeePass web and desktop client

#31

Post by florianletsch »

ngrilly wrote: post #24
wwarren wrote: post #2

This is awesome. People are obviously going to give you a hard time about security and your implementation of the important parts of the software, but that's the advantage of open source! Edit: I am a daily user of KeePassX and get really tired of the UI after a while so I will definitely be trying this out ASAP!

Which version of KeePassX are you using? The 2.0 seems better. And if you use a Mac, have you tried MacPass?

MacPass is excellent. It finally helped me completely move to a password manager based life.

Re: KeeWeb: Unofficial KeePass web and desktop client

#32

Post by C0d3r »

phjesusthatguy3 wrote: post #10

That's pretty nice. I'm going to look into packaging it for myself for FirefoxOS. My only issue with it right now is aesthetic: the top item (search box on the main page, " http://builds.firefoxos.mozfr.org/doc/en/devices/zte-open-c-...

Offtopic but, are you using FirefoxOS in your main phone? Is it good enough? I have one but never found it useful...

Re: KeeWeb: Unofficial KeePass web and desktop client

#33

Post by lorenzhs »

magicmu wrote: post #7

Looks awesome! I've been using 1password, are there any big advantages that KeePass has over it?

I'm a big fan of FLOSS solutions, but I can't recommend KeePass/KeePassX/... over 1password. There are many people implementing KeePass-related things and most of them don't know much about secure development (nor do I claim to). 1password on the other hand has audits and professional security people. As long as they don't turn evil and give you a bad binary blob, I would bet on your passwords being more secure with them than if you were using one of the KeePass* tools.

Re: KeeWeb: Unofficial KeePass web and desktop client

#34

Post by datamoshr »

Sir_Cmpwn wrote: post #27

Check out pass for those wanting a solution in line with the Unix way: https://www.passwordstore.org/

I've previously looked into this and stopped half way through migrating my lastpass. I have a rather naive question: For the replication across devices this tool relies on git, but where are folks setting up the origin?

Re: KeeWeb: Unofficial KeePass web and desktop client

#36

Post by judofyr »

dchest wrote: post #29

Do not generate passwords with it, it uses insecure Math.random: https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3... https://github.com/antelle/keeweb/blob/master/app/scripts/ut... (in meme form: https://imgur.com/FcZNflQ ) Filed issue: https://github.com/antelle/kdbxweb/issues/5 (embarrassing/funny: it was me who wrote Salsa20 "user-space" generator used here ( https://github.com/antelle/kdbxweb/blob/906…

Is there a practical attack for this usage? The attacker would need to have a bunch of your passwords already?

EDIT: Not that I'm justifying using Math.random, I just don't see why you so strongly recommend against using this tool.

Re: KeeWeb: Unofficial KeePass web and desktop client

#37

Post by Sir_Cmpwn »

datamoshr wrote: post #34
Sir_Cmpwn wrote: post #27

Check out pass for those wanting a solution in line with the Unix way: https://www.passwordstore.org/

I've previously looked into this and stopped half way through migrating my lastpass. I have a rather naive question: For the replication across devices this tool relies on git, but where are folks setting up the origin?

I host mine on gogs.sr.ht, a private git service I run for myself and friends. I used to host it on a private GitHub repository. There are other options like a private Bitbucket repository, or even just a public repo on GitHub - since the passwords are all encrypted, you don't really have to worry about that.

I'll happily give an sr.ht account to anyone who wants one for this purpose, mention HN in your application comments: https://sr.ht

Re: KeeWeb: Unofficial KeePass web and desktop client

#38

Post by dangerlibrary »

dchest wrote: post #29

Do not generate passwords with it, it uses insecure Math.random: https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3... https://github.com/antelle/keeweb/blob/master/app/scripts/ut... (in meme form: https://imgur.com/FcZNflQ ) Filed issue: https://github.com/antelle/kdbxweb/issues/5 (embarrassing/funny: it was me who wrote Salsa20 "user-space" generator used here ( https://github.com/antelle/kdbxweb/blob/906…

Just so we're clear: your assertion is that because the password generator uses a non-cryptographically secure PRNG, generating unique 20+ character alphanumeric passwords for every login is worse than people's default behavior?

I mean, I get that it's worse than other keepass implementations - that's obviously a problem - but if this gets people to stop using "hunter2" or "p4$$w0rd" that's got to be worth something, right?

Re: KeeWeb: Unofficial KeePass web and desktop client

#39

Post by oneeyedpigeon »

dorfsmay wrote: post #26
oneeyedpigeon wrote: post #20

Earlier quoted context omitted.

> the advantage of keepass is that I don't need to upload my credentials anywhere But if you want to sync your credentials across devices, you still have to upload them somewhere, right? Doesn't this just support sync via Dropbox? If so, aren't you then just playing the trust game between two third-parties?

You are uploading a file that is encrypted using very strong encryption, not plain text password. An employee of that company, or if the file was leaked due to technical errors, a member of the general public won't be able to decrypt it. If one of the richest governments wanted to, they might be able to, but if you had reasons to be a target you'd know better than using this. Also, take a look at SpiderOak.

Is strong-encryption something that 1password is fundamentally opposed to, or something they just haven't implemented yet? If I'm going to switch, the answer to question is pretty important.

Re: KeeWeb: Unofficial KeePass web and desktop client

#40

Post by softawre »

florianletsch wrote: post #31
ngrilly wrote: post #24

Earlier quoted context omitted.

Which version of KeePassX are you using? The 2.0 seems better. And if you use a Mac, have you tried MacPass?

MacPass is excellent. It finally helped me completely move to a password manager based life.

How is it better than KeyPassX? I (think I) want my manager to be simple..
Post reply on HN