Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeeWeb: Unofficial KeePass web and desktop client

github.com

Post reply on HN
Print view View original

51–60 of 125 posts

Re: KeeWeb: Unofficial KeePass web and desktop client

#51

Post by forty »

oneeyedpigeon wrote: post #39
dorfsmay wrote: post #26

Earlier quoted context omitted.

You are uploading a file that is encrypted using very strong encryption, not plain text password. An employee of that company, or if the file was leaked due to technical errors, a member of the general public won't be able to decrypt it. If one of the richest governments wanted to, they might be able to, but if you had reasons to be a target you'd know better than using this. Also, take a look at SpiderOak.

Is strong-encryption something that 1password is fundamentally opposed to, or something they just haven't implemented yet? If I'm going to switch, the answer to question is pretty important.

I work for a competitor of 1password, and as far as I know 1password is one of the "serious" password managers and I really doubt they would store data unencrypted. Last time I checked, they did not offer cloud sync directly, but integrated with dropbox to store your encrypted vault. Not really sure what the previous comment wanted to imply.

Re: KeeWeb: Unofficial KeePass web and desktop client

#53

Post by ivanhoe »

talles wrote: post #8

I always get confused with KeePass, KeePass2 and KeePassX... I use KeePassX on OS X. Will I be able to use this one with my database file?

The latest version of KeePassX is using the same database format as KeePass2 and this app, so you should be ok. If you are using older (KeePass v1 compatible) format of the database just upgrade it in the lates version of KeePassX, it will convert all the data for you.

Re: KeeWeb: Unofficial KeePass web and desktop client

#55

Post by yoasif_ »

ngrilly wrote: post #25
talles wrote: post #8

I always get confused with KeePass, KeePass2 and KeePassX... I use KeePassX on OS X. Will I be able to use this one with my database file?

Try MacPass. It's great. http://mstarke.github.io/MacPass/

Thanks, giving this a shot!

Re: KeeWeb: Unofficial KeePass web and desktop client

#56

Post by eterm »

dchest wrote: post #44
judofyr wrote: post #36

Earlier quoted context omitted.

Is there a practical attack for this usage? The attacker would need to have a bunch of your passwords already? EDIT: Not that I'm justifying using Math.random, I just don't see why you so strongly recommend against using this tool.

I don't know of any published attacks on XorShift128+, which is used in most browsers for Math.random. What I know is that it's not a cryptographically secure PRNG, though, so all you have to do is sit and wait for one ;-)

I believe window.crypto should be used.

https://developer.mozilla.org/en-US/docs/Web/API/RandomSourc...

> The RandomSource.getRandomValues() method lets you get cryptographically random values. The array given as the parameter is filled with random numbers (random in its cryptographic meaning).

> To guarantee enough performance, implementations are not using a truly random number generator, but they are using a pseudo-random number generator seeded with a value with enough entropy. The PRNG used differs from one implementation to the other but is suitable for cryptographic usages. Implementations are also required to use a seed with enough entropy, like a system-level entropy source.

Re: KeeWeb: Unofficial KeePass web and desktop client

#57

Post by wodenokoto »

dchest wrote: post #41
dangerlibrary wrote: post #38

Earlier quoted context omitted.

Just so we're clear: your assertion is that because the password generator uses a non-cryptographically secure PRNG, generating unique 20+ character alphanumeric passwords for every login is worse than people's default behavior? I mean, I get that it's worse than other keepass implementations - that's obviously a problem - but if this gets people to stop using "hunter2" or "p4$$w0rd" that's got to be worth something,…

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

Re: KeeWeb: Unofficial KeePass web and desktop client

#58

Post by scurvy »

oneeyedpigeon wrote: post #20
cmrx64 wrote: post #16

Earlier quoted context omitted.

I'm not sure about "big", it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere, or trust some closed source blob running in the browser, etc. It has a XML format that enables things like this client to be created. 1password has the advantage of excellent platform integration on iOS, and various browser ext…

> the advantage of keepass is that I don't need to upload my credentials anywhere But if you want to sync your credentials across devices, you still have to upload them somewhere, right? Doesn't this just support sync via Dropbox? If so, aren't you then just playing the trust game between two third-parties?

Use a p2p sync program like BitTorrent sync or an alternative. Skip the cloud. It's just someone else's computer.

Re: KeeWeb: Unofficial KeePass web and desktop client

#59

Post by dchest »

eterm wrote: post #56
dchest wrote: post #44

Earlier quoted context omitted.

I don't know of any published attacks on XorShift128+, which is used in most browsers for Math.random. What I know is that it's not a cryptographically secure PRNG, though, so all you have to do is sit and wait for one ;-)

I believe window.crypto should be used. https://developer.mozilla.org/en-US/docs/Web/API/RandomSourc... > The RandomSource.getRandomValues() method lets you get cryptographically random values. The array given as the parameter is filled with random numbers (random in its cryptographic meaning). > To guarantee enough performance, implementations are not using a truly random number generator, but they are using a pseud…

Correct, I provided browser (using window.crypto) & Node (crypto) compatible implementation in the bug report: https://github.com/antelle/kdbxweb/issues/5

Re: KeeWeb: Unofficial KeePass web and desktop client

#60

Post by brbsix »

wodenokoto wrote: post #57
dchest wrote: post #41

Earlier quoted context omitted.

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

I hope that's not a common use case (among the technologically literate). I would expect said individuals to have far more passwords of sufficient length and complexity (not to mention duration) than could reasonably be remembered.
Post reply on HN