71–78 of 78 posts
Well I'm glad I switched off of keepass awhile back. Anyone know any good password managers that have web login and support U2F? Lastpass does not :(
I just use a gpg-encrypted org-mode file (I can transparently decrypt it with emacs). It's remarkably convenient, and I don't have to worry about software going out of support.
That's wild, I didn't expect any security-centric website in 2016 to be HTTP-only! The reasoning for not doing it is weird too, they could at the very least move the update logic over to a separate SSL endpoint. Anyway, I'm not quite sure on the differences between them but I've been using KeePassX for years and recommend it thoroughly (as long as you're not looking for a easily synced or multi-user product): https:/…
> That's wild, I didn't expect any security-centric website in 2016 to be HTTP-only! Both of the websites for PuTTY (www.putty.org and www.chiark.greenend.org.uk) are also non-encrypted. At least the downloads are hosted on a third server (the.earth.li) which does use HTTPS and 2048-bit GPG signatures are provided.
It's free software; You have no right to complain or dictate priorities when you aren't paying for it. You aren't the customer, KeePass 2 advertisers are. Use 1password and pay $5 a month if you want the right to complain.
> It's free software; It is not free software, it's proprietary. Please don't use the phrase "free software" in this context, as it confuses people. It has a very specific meaning in the context of software.
The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution. How does HTTPS result in lost ad revenue?
The answers here are off the mark. You can obviously have the update channel use HTTPS and keep your website at HTTP (not recommended, but certainly possible). Or just sign the updates and version information.
Why is there advertisement on the automated update server? Why can't he just split them apart? What with things like Let's Encrypt nowadays, there really shouldn't be any excuse not to use https. Especially for a security related product!
So any possible attack against KeePass would as most cause the notification dialog to appear saying there's a new version.
anyway, the author found a solution by signing the text file that the update checker looks at. IMO, that's a superior solution to HTTPS. He's posted a statement on the KeePass website. http://keepass.info/help/kb/sec_issues.html#updsig
I was always skeptical of KeePass which is why I've been using KeePassX. It is just a simple Qt app. Unfortunately there is no KeePassHttp support yet, so you can't hook it up to your browser, but there is a fork available with full support. https://github.com/droidmonkey/keepassx_http/
I looked at KeePassX several years ago but it didn't have as many security features as KeePass. For example, KeePass supports entering the password via secure desktop where KeePassX didn't.
I was always skeptical of KeePass which is why I've been using KeePassX. It is just a simple Qt app. Unfortunately there is no KeePassHttp support yet, so you can't hook it up to your browser, but there is a fork available with full support. https://github.com/droidmonkey/keepassx_http/
Why have you always been skeptical of KeePass? What is it about KeePassX that reassured you? I looked at KeePassX several years ago but it didn't have as many security features as KeePass. For example, KeePass supports entering the password via secure desktop where KeePassX didn't.
Earlier quoted context omitted.
Why have you always been skeptical of KeePass? What is it about KeePassX that reassured you? I looked at KeePassX several years ago but it didn't have as many security features as KeePass. For example, KeePass supports entering the password via secure desktop where KeePassX didn't.
KeePassX doesn't do auto-updating, for one. I am kind of a purist when it comes to software, and anything that feels clunky and bloated I'm just going to assume is made by people with insufficient competence. And truly, nobody is competent enough on their own, it requires a community. And it is much easier to collaborate through github than through... however it is that KeePass does it.