Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeeWeb: Unofficial KeePass web and desktop client

github.com

Post reply on HN
Print view View original

71–80 of 125 posts

Re: KeeWeb: Unofficial KeePass web and desktop client

#71

Post by scurvy »

oneeyedpigeon wrote: post #70
scurvy wrote: post #58

Earlier quoted context omitted.

Use a p2p sync program like BitTorrent sync or an alternative. Skip the cloud. It's just someone else's computer.

But it's someone else's computer that is pretty much guaranteed to be available, and probably more secure than mine.

There are mobile clients for phones if you don't have an always on machine.

Also, you're putting too much faith in other people's computers.

That said, most of these password managers use really strong encryption so having your password file exposed isn't much of an issue.

Re: KeeWeb: Unofficial KeePass web and desktop client

#73

Post by caskance »

lorenzhs wrote: post #33
magicmu wrote: post #7

Looks awesome! I've been using 1password, are there any big advantages that KeePass has over it?

I'm a big fan of FLOSS solutions, but I can't recommend KeePass/KeePassX/... over 1password. There are many people implementing KeePass-related things and most of them don't know much about secure development (nor do I claim to). 1password on the other hand has audits and professional security people. As long as they don't turn evil and give you a bad binary blob, I would bet on your passwords being more secure with…

Sure, in theory, 1password MIGHT have better private auditing and review. But there's no reason to believe they do. To the contrary, when asked about open sourcing 1password, one of their developers explained that they don't do formal code review because it's too expensive, and that none of the external experts they consulted with have ever performed a full review.

https://discussions.agilebits.com/discussion/22686/open-sour...

Re: KeeWeb: Unofficial KeePass web and desktop client

#74

Post by dchest »

Quiark wrote: post #67
takluyver wrote: post #62

Earlier quoted context omitted.

Lastpass, being primarily a browser plugin, makes generated passwords much more convenient. When I'm setting up a new account, I press Alt-G to bring up the generator dialog, and then it auto-fills when I need to log in. I honestly don't know most of my passwords (I still memorise my primary email password, so I'm not totally stuck if I lost access to LastPass). This is a compromise, because I'd prefer to trust an op…

Makes me wonder if LastPass uses CS PRNG for that :D

Last time I checked I think they used some kind of user-space RC4-based PRNG, but it was seeded properly from window.crypto.

Re: KeeWeb: Unofficial KeePass web and desktop client

#75

Post by Touche »

dchest wrote: post #41
dangerlibrary wrote: post #38

Earlier quoted context omitted.

Just so we're clear: your assertion is that because the password generator uses a non-cryptographically secure PRNG, generating unique 20+ character alphanumeric passwords for every login is worse than people's default behavior? I mean, I get that it's worse than other keepass implementations - that's obviously a problem - but if this gets people to stop using "hunter2" or "p4$$w0rd" that's got to be worth something,…

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

Security experts are really bad about explaining their positions. I don't doubt that you are right, but can you lay out the scenario for me where my Reddit account will be hacked because I used Math.random() to generate the password?

Re: KeeWeb: Unofficial KeePass web and desktop client

#77

Post by Touche »

dchest wrote: post #46
blakesterz wrote: post #42

Earlier quoted context omitted.

>> Is there a practical attack for this usage? This is the question I ask every single time I read about anything in security. It feels like there's just SO MANY THINGS wrong about every damn thing now the only way I can figure out what I have to really worry about or focus on is anything with a PRACTICAL attack that's easily automated and remotely exploitable.

Cryptographic attacks become better, some of them become practical. RC4 attacks were not considered practical until recently, and now everyone runs with their heads on fire replacing it. The best answer is to listen to what security people say. When they have a practical attack on something it is already too late.

Security experts, by in large, only care about academics and care very little about usability, so I do not trust them unless they give me specific scenarios where I am in danger.

Re: KeeWeb: Unofficial KeePass web and desktop client

#79

Post by myhandy »

slazaro wrote: post #28
supergreg wrote: post #23

Earlier quoted context omitted.

I use my own script to generate passwords. I don't store anything beyond a salt. The password is just a hash of the website name, the salt and a master password. Then I just copypaste the result. Simple is best.

Is there a name for this kind of scheme where you can generate a password every time because you have all the parts needed? I've been seeing that people do this but don't have a name for it.

Hashing?
Post reply on HN