Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeeWeb: Unofficial KeePass web and desktop client

github.com

Post reply on HN
Print view View original

81–90 of 125 posts

Re: KeeWeb: Unofficial KeePass web and desktop client

#81

Post by disillusioned »

dchest wrote: post #41
dangerlibrary wrote: post #38

Earlier quoted context omitted.

Just so we're clear: your assertion is that because the password generator uses a non-cryptographically secure PRNG, generating unique 20+ character alphanumeric passwords for every login is worse than people's default behavior? I mean, I get that it's worse than other keepass implementations - that's obviously a problem - but if this gets people to stop using "hunter2" or "p4$$w0rd" that's got to be worth something,…

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

As a matter of policy, no, you should never say "YOLO."

Re: KeeWeb: Unofficial KeePass web and desktop client

#82

Post by dchest »

Touche wrote: post #77
dchest wrote: post #46

Earlier quoted context omitted.

Cryptographic attacks become better, some of them become practical. RC4 attacks were not considered practical until recently, and now everyone runs with their heads on fire replacing it. The best answer is to listen to what security people say. When they have a practical attack on something it is already too late.

Security experts, by in large, only care about academics and care very little about usability, so I do not trust them unless they give me specific scenarios where I am in danger.

Eh, okay? Your choice, dear Touche, your choice.

Re: KeeWeb: Unofficial KeePass web and desktop client

#83

Post by dang »

slavik81 wrote: post #80

The title should probably be "KeyWeb - a KeePass Web and desktop client" to be clear that this is not the official KeePass client. I was briefly concerned because I generated many passwords with KeePass, but this post is about a different piece of software.

We added "unofficial" to the title.

Re: KeeWeb: Unofficial KeePass web and desktop client

#84

Post by dchest »

disillusioned wrote: post #81
dchest wrote: post #41

Earlier quoted context omitted.

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

As a matter of policy, no, you should never say "YOLO."

:-)

Re: KeeWeb: Unofficial KeePass web and desktop client

#85

Post by noondip »

zipperhead wrote: post #45
Sir_Cmpwn wrote: post #27

Check out pass for those wanting a solution in line with the Unix way: https://www.passwordstore.org/

One issue I have with pass is that it leaks meta-data about what you have stored. The contents are encrypted, yes, but the filename identifying the content is sitting right there in the open.

Check out this similar gpg-based password manager, which uses just one encrypted container for improved confidentiality - https://github.com/drduh/pwd.sh

Re: KeeWeb: Unofficial KeePass web and desktop client

#86

Post by Touche »

dchest wrote: post #82
Touche wrote: post #77

Earlier quoted context omitted.

Security experts, by in large, only care about academics and care very little about usability, so I do not trust them unless they give me specific scenarios where I am in danger.

Eh, okay? Your choice, dear Touche, your choice.

Just to clarify what I mean; we have to make decisions based on tradeoffs. Having the most secure password possible is not the only thing that matters. So "trust security experts" is not a good response; I need to know threat levels so I can make informed decisions. I'm not just going to do the same thing a security enthusiast does because I value different things, to different degrees.

Re: KeeWeb: Unofficial KeePass web and desktop client

#87

Post by dchest »

Touche wrote: post #86
dchest wrote: post #82

Earlier quoted context omitted.

Eh, okay? Your choice, dear Touche, your choice.

Just to clarify what I mean; we have to make decisions based on tradeoffs. Having the most secure password possible is not the only thing that matters. So "trust security experts" is not a good response; I need to know threat levels so I can make informed decisions. I'm not just going to do the same thing a security enthusiast does because I value different things, to different degrees.

Looks like you didn't understand the sadness of the issue I was reporting. The author of the software constructed his own random number generator from two primitives: Salsa20 stream generator and Math.random. The last part is what makes this PRNG theoretically insecure: because Math.random is not guaranteed to give cryptographically secure random numbers, thus, theoretically, the generated passwords can be guessed. (The fact that there are no current attacks on current implementations of Math.random in browsers doesn't mean that we won't get them in the future.) The secure alternative to author's PRNG is ~one line of code: window.crypto.getRandomBytes. There are no tradeoffs involved! On the contrary, the author's insecure construction is more difficult to write than the secure one.

(BTW, while we here argue about security experts, the author said "Thank you, I'll replace it of course.")

Re: KeeWeb: Unofficial KeePass web and desktop client

#88

Post by relaxitup »

Does there exist an enterprise grade server/webui solution based on a keepass db? We are looking for an enterprise password manager solution that does not need all the ldap/ad integration bells/whistles (although we may explore ldap integration with the tool in the future). So I was thinking why not just use keepass. And by enterprise grade I guess I really mean it needs to be a multi user solution, but everyone would be working from the same pw db..

Re: KeeWeb: Unofficial KeePass web and desktop client

#89

Post by simcop2387 »

Quiark wrote: post #66
m3Lith wrote: post #63

Earlier quoted context omitted.

There's addons for Firefox/Chrome as well as apps for Android that enable autofill and other stuff you might expect from a modern password manager (making the UX pretty close to LastPass).

Some warnings: don't use Android clipboard for passwords - AFAIK apps can get notifications when clipboard changes. Don't enable remote connections to the KeepassHttp browser integration: there's a gaping hole https://github.com/pfn/keepasshttp/issues/258

I've been pretty happy with keepass2android's keyboard integration. It avoids the clipboard entirely and helps autoselect the right password and username if you let it. It also supports using a HOTP NFC token in conjunction with the master password.

I know it doesn't add that much security since a determined attacker could still brute force the OTP with the way it works but it keeps out the casual attacker that's not that savvy.

Re: KeeWeb: Unofficial KeePass web and desktop client

#90

Post by jbmorgado »

dangerlibrary wrote: post #38
dchest wrote: post #29

Do not generate passwords with it, it uses insecure Math.random: https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3... https://github.com/antelle/keeweb/blob/master/app/scripts/ut... (in meme form: https://imgur.com/FcZNflQ ) Filed issue: https://github.com/antelle/kdbxweb/issues/5 (embarrassing/funny: it was me who wrote Salsa20 "user-space" generator used here ( https://github.com/antelle/kdbxweb/blob/906…

Just so we're clear: your assertion is that because the password generator uses a non-cryptographically secure PRNG, generating unique 20+ character alphanumeric passwords for every login is worse than people's default behavior? I mean, I get that it's worse than other keepass implementations - that's obviously a problem - but if this gets people to stop using "hunter2" or "p4$$w0rd" that's got to be worth something,…

No, I think it just means that's worst than using another password generator that does this right.

I know the probability that vulnerability will be exploited is very low. But I also believe things should be done the right way.

Use another password manager, or just use KeepPass official to create the passwords.

Post reply on HN