Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeeWeb: Unofficial KeePass web and desktop client

github.com

Post reply on HN
Print view View original

61–70 of 125 posts

Re: KeeWeb: Unofficial KeePass web and desktop client

#61

Post by phjesusthatguy3 »

C0d3r wrote: post #32
phjesusthatguy3 wrote: post #10

That's pretty nice. I'm going to look into packaging it for myself for FirefoxOS. My only issue with it right now is aesthetic: the top item (search box on the main page, " http://builds.firefoxos.mozfr.org/doc/en/devices/zte-open-c-...

Offtopic but, are you using FirefoxOS in your main phone? Is it good enough? I have one but never found it useful...

Yes, my only phone is FxOS. No, it's not good enough. I'm sure if I was on better hardware, it would be okay. My only requirements for it are a) decent web browser (it fails on this point) and b) Google 2 factor auth (I'm using GAuth[0]). I really don't care about playing games on my phone (I have a hacked PS Vita for that) and I have a laptop for everything else.

[0]https://marketplace.firefox.com/app/gauth

Re: KeeWeb: Unofficial KeePass web and desktop client

#62

Post by takluyver »

wodenokoto wrote: post #57
dchest wrote: post #41

Earlier quoted context omitted.

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

Lastpass, being primarily a browser plugin, makes generated passwords much more convenient. When I'm setting up a new account, I press Alt-G to bring up the generator dialog, and then it auto-fills when I need to log in. I honestly don't know most of my passwords (I still memorise my primary email password, so I'm not totally stuck if I lost access to LastPass).

This is a compromise, because I'd prefer to trust an open source tool and an encrypted local file, but I trust Lastpass enough, and the convenience is very nice.

Re: KeeWeb: Unofficial KeePass web and desktop client

#63

Post by m3Lith »

wodenokoto wrote: post #57
dchest wrote: post #41

Earlier quoted context omitted.

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

There's addons for Firefox/Chrome as well as apps for Android that enable autofill and other stuff you might expect from a modern password manager (making the UX pretty close to LastPass).

Re: KeeWeb: Unofficial KeePass web and desktop client

#64

Post by wwarren »

ngrilly wrote: post #24
wwarren wrote: post #2

This is awesome. People are obviously going to give you a hard time about security and your implementation of the important parts of the software, but that's the advantage of open source! Edit: I am a daily user of KeePassX and get really tired of the UI after a while so I will definitely be trying this out ASAP!

Which version of KeePassX are you using? The 2.0 seems better. And if you use a Mac, have you tried MacPass?

I think 2.0 fixed a lot of things, but the interface is still pretty painful (my opinion). Still usable of course, like I said I use it all day every day.

Haven't tried MacPass but it looks great and I will give it a whirl. Thanks!

Re: KeeWeb: Unofficial KeePass web and desktop client

#65

Post by m3Lith »

takluyver wrote: post #62
wodenokoto wrote: post #57

Earlier quoted context omitted.

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

Lastpass, being primarily a browser plugin, makes generated passwords much more convenient. When I'm setting up a new account, I press Alt-G to bring up the generator dialog, and then it auto-fills when I need to log in. I honestly don't know most of my passwords (I still memorise my primary email password, so I'm not totally stuck if I lost access to LastPass). This is a compromise, because I'd prefer to trust an op…

There's addons for Firefox (KeeFox) and Chrome (ChromeIPass), making the UX of KeePass pretty much the same as of LastPass. I've switched about a month ago and am happy.

Re: KeeWeb: Unofficial KeePass web and desktop client

#66

Post by Quiark »

m3Lith wrote: post #63
wodenokoto wrote: post #57

Earlier quoted context omitted.

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

There's addons for Firefox/Chrome as well as apps for Android that enable autofill and other stuff you might expect from a modern password manager (making the UX pretty close to LastPass).

Some warnings: don't use Android clipboard for passwords - AFAIK apps can get notifications when clipboard changes.

Don't enable remote connections to the KeepassHttp browser integration: there's a gaping hole https://github.com/pfn/keepasshttp/issues/258

Re: KeeWeb: Unofficial KeePass web and desktop client

#67

Post by Quiark »

takluyver wrote: post #62
wodenokoto wrote: post #57

Earlier quoted context omitted.

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?

Lastpass, being primarily a browser plugin, makes generated passwords much more convenient. When I'm setting up a new account, I press Alt-G to bring up the generator dialog, and then it auto-fills when I need to log in. I honestly don't know most of my passwords (I still memorise my primary email password, so I'm not totally stuck if I lost access to LastPass). This is a compromise, because I'd prefer to trust an op…

Makes me wonder if LastPass uses CS PRNG for that :D

Re: KeeWeb: Unofficial KeePass web and desktop client

#68

Post by oneeyedpigeon »

DenisM wrote: post #49
oneeyedpigeon wrote: post #39

Earlier quoted context omitted.

Is strong-encryption something that 1password is fundamentally opposed to, or something they just haven't implemented yet? If I'm going to switch, the answer to question is pretty important.

>strong-encryption something that 1password is fundamentally opposed to? where did you this idea?

The comment I replied to which suggested that strong-encryption was a differential between keepass and 1password.

Re: KeeWeb: Unofficial KeePass web and desktop client

#69

Post by rcthompson »

ngrilly wrote: post #24
wwarren wrote: post #2

This is awesome. People are obviously going to give you a hard time about security and your implementation of the important parts of the software, but that's the advantage of open source! Edit: I am a daily user of KeePassX and get really tired of the UI after a while so I will definitely be trying this out ASAP!

Which version of KeePassX are you using? The 2.0 seems better. And if you use a Mac, have you tried MacPass?

A warning about Macpass: After I saved my Keepass database with Macpass, KeepassX couldn't open it any more. So keep a backup unless you're sure you want to switch permanently. This probably applies to switching from any password manager to any other, honestly.

(I think I was able to fix it in that case by opening and saving it with Keepass.)

Re: KeeWeb: Unofficial KeePass web and desktop client

#70

Post by oneeyedpigeon »

scurvy wrote: post #58
oneeyedpigeon wrote: post #20

Earlier quoted context omitted.

> the advantage of keepass is that I don't need to upload my credentials anywhere But if you want to sync your credentials across devices, you still have to upload them somewhere, right? Doesn't this just support sync via Dropbox? If so, aren't you then just playing the trust game between two third-parties?

Use a p2p sync program like BitTorrent sync or an alternative. Skip the cloud. It's just someone else's computer.

But it's someone else's computer that is pretty much guaranteed to be available, and probably more secure than mine.
Post reply on HN