KeeWeb: Unofficial KeePass web and desktop client

Post by paulryanrogers » Thu, Feb 25, 2016, 6:52 PM UTC

relaxitup wrote: post #88

Does there exist an enterprise grade server/webui solution based on a keepass db? We are looking for an enterprise password manager solution that does not need all the ldap/ad integration bells/whistles (although we may explore ldap integration with the tool in the future). So I was thinking why not just use keepass. And by enterprise grade I guess I really mean it needs to be a multi user solution, but everyone woul…

Post by Touche » Thu, Feb 25, 2016, 6:58 PM UTC

dchest wrote: post #87

Touche wrote: post #86

Earlier quoted context omitted.

Just to clarify what I mean; we have to make decisions based on tradeoffs. Having the most secure password possible is not the only thing that matters. So "trust security experts" is not a good response; I need to know threat levels so I can make informed decisions. I'm not just going to do the same thing a security enthusiast does because I value different things, to different degrees.

Looks like you didn't understand the sadness of the issue I was reporting. The author of the software constructed his own random number generator from two primitives: Salsa20 stream generator and Math.random. The last part is what makes this PRNG theoretically insecure: because Math.random is not guaranteed to give cryptographically secure random numbers, thus, theoretically, the generated passwords can be guessed. (…

Post by DenisM » Thu, Feb 25, 2016, 7:17 PM UTC

oneeyedpigeon wrote: post #68

DenisM wrote: post #49

Earlier quoted context omitted.

>strong-encryption something that 1password is fundamentally opposed to? where did you this idea?

The comment I replied to which suggested that strong-encryption was a differential between keepass and 1password.

Post by dorfsmay » Thu, Feb 25, 2016, 7:25 PM UTC

oneeyedpigeon wrote: post #39

dorfsmay wrote: post #26

Earlier quoted context omitted.

You are uploading a file that is encrypted using very strong encryption, not plain text password. An employee of that company, or if the file was leaked due to technical errors, a member of the general public won't be able to decrypt it. If one of the richest governments wanted to, they might be able to, but if you had reasons to be a target you'd know better than using this. Also, take a look at SpiderOak.

Is strong-encryption something that 1password is fundamentally opposed to, or something they just haven't implemented yet? If I'm going to switch, the answer to question is pretty important.

Post by rudolf0 » Thu, Feb 25, 2016, 8:27 PM UTC

wodenokoto wrote: post #57

dchest wrote: post #41

Earlier quoted context omitted.

No, it's not worse for your scenario. (That wasn't my assertion) However, this is an alternative to KeePass/KeePassX, so the typical behavior of KeePass users is to generate passwords with it, not reuse bad passwords. For example, I use KeePassX to generate strong passwords for long-term encrypted archives, and if I switched to this app, I wouldn't get the same security. I'm confused, though, should I say: "All right…

I use KeePass and I don't use it to generate passwords. It's a pain to open and close every time I need to login somewhere, especially if I'm on mobile. I use it for when I forget my passwords, and I honestly believe that is the common use case, but who knows?