Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

141–150 of 347 posts

Re: On Password Managers

#141

Post by kronos29296 »

6ak74rfy wrote: post #132
kronos29296 wrote: post #55

Earlier quoted context omitted.

Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained). I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.

Have you used KeepassXC. I am panning to move to it from lastpass, and want to make sure I am making the right choice.

KeepassXC does not support the latest kdbx 4 format which was recently released with Argon2 support. (which is supposed to be more secure). It will be supported in the next release 2.3.0. So for now I use Keepass until it supports kdbx 4 then I will move back. It has no plugins though compared to keepass.

Other than that it has better gui if that is your thing (Keepass is ugly). It is mostly a fork of keepassx which is still usable but KeepassXC merged all pull requests and fixed a load of bugs in keepassx after the maintainer stopped maintaining. Try it. It works. It also has mutilple releases (snap, appimage etc.).

Re: On Password Managers

#142

Post by dingdongding »

guelo wrote: post #50

Against all recommendations I reject all password managers. I feel like all security software is eventually compromised, most frequently by business folks as in this case. Instead I use a tiny notebook that I keep in my wallet. I pick long 12+ character passwords myself, not super randomized but I haven't heard of a brute forcing attack in a long time. It allows me to easily meet weird password requirements. I feel p…

So basically a robber can not just rob you of your physical things, he can rob you digitally as well. How is this more safer than password managers?

Re: On Password Managers

#143

Post by kronos29296 »

bmurphy1976 wrote: post #119
kronos29296 wrote: post #55

Earlier quoted context omitted.

Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained). I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.

If you can stomach an electron app Keeweb is a nice keepass compatible alternative.

I can't. Atom has given me electron trauma (older versions about a couple of years back).

Re: On Password Managers

#144

Post by AbacusAvenger »

6ak74rfy wrote: post #132
kronos29296 wrote: post #55

Earlier quoted context omitted.

Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained). I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.

Have you used KeepassXC. I am panning to move to it from lastpass, and want to make sure I am making the right choice.

I've used KeePassXC, and I think it's the best KeePass variant. I don't like stock KeePass because it's horribly slow under Mono (Linux/OS X). And I like but am not as satisfied with KeePassX because it lacks some features I like. From what I recall, the maintainers of KeePassXC got frustrated with the feature set and development pace of KeePassX, so they made their own fork. And they added nice things like TOTP code generation (i.e. Google Authenticator style) and YubiKey support.

I can't yet wean myself off of LastPass though, just because it's synced everywhere and is more reliable when doing form fills on websites. For example, KeePass and its variants don't have a concept of equivalent domains. For "equivalent domains" I should be prompted with the same lists of auto-fillable credentials, such as:

* youtube.com/google.com/gmail.com

* bing.com/hotmail.com/live.com/microsoft.com/msn.com/passport.net/windows.com

* apple.com/icloud.com

LastPass gets this right, but I sadly haven't seen any other password manager that does. I think there's an open issue with KeePassXC to address this but it's not merged or production ready.

Re: On Password Managers

#145

Post by bndw »

corybrown wrote: post #101

I've moved from LastPass to KeePass, but the biggest thing I miss from LastPass (other than the better browser integration) is a good CLI client. Lastpass-cli is great, and kpcli just isn't. Anyone have a recommendation for a good CLI client that isn't `pass`? (I don't want to deal with GPG)

Pick[1] is a CLI password manager that I've been working on for a couple years. There is no browser or mobile support, however.

[1] https://github.com/bndw/pick

Re: On Password Managers

#146

Post by monster_group »

jmcphers wrote: post #48
danirod wrote: post #25

Earlier quoted context omitted.

I use KeePass to store my passwords plus other sensible data. It's multiplatform and I can have access to my passwords file on macOS using MacPass, on Linux and Windows using KeePassX, and on Android using KeePass2Android. I use Dropbox to sync the file through multiple computers including my Android phone. I don't fully trust Dropbox for sensible stuff, but since the passwords file is encrypted by KeePass, I conside…

This is exactly what I've done for years. The only difference is that I'm so paranoid about losing my keyfile (and with it all my passwords) that I also put it on the cloud -- just not on the same cloud provider as the keepass database.

Copy it to thumb drive and put in a bank deposit box as a backup. You can then do away with having your key in the cloud.

Re: On Password Managers

#147

Post by corybrown »

bndw wrote: post #145
corybrown wrote: post #101

I've moved from LastPass to KeePass, but the biggest thing I miss from LastPass (other than the better browser integration) is a good CLI client. Lastpass-cli is great, and kpcli just isn't. Anyone have a recommendation for a good CLI client that isn't `pass`? (I don't want to deal with GPG)

Pick[1] is a CLI password manager that I've been working on for a couple years. There is no browser or mobile support, however. [1] https://github.com/bndw/pick

Looks nice, thanks for the pointer.

Have you ever considered using a keepass database as the store? Would give you mobile / gui / etc clients. I'd definitely use it :)

Re: On Password Managers

#148

Post by conradk »

zokier wrote: post #125
[deleted] wrote: post #117

Earlier quoted context omitted.

[deleted]

Just curious, is there a reason why you decided to design your own storage format instead of reusing kdbx4?

Thanks for the question. Frankly, at the time, I was under the impression that Keypass what a quite powerful and thus complex beast. I wanted something simple with just the data I needed saved (ie app name, username and password, nothing more) so I went ahead and created the new format.

It was actually interesting to work on a new file format. The version 1 was not formally versioned. I realised that for the version 2, I would need to add a version number to the file format. Of course, the world doesn't care about any of that, but I learned something doing it and am happy about that.

Re: On Password Managers

#149

Post by csarva »

softawre wrote: post #67
irrational wrote: post #26

Earlier quoted context omitted.

Does anyone at your company use iOS? If so, how are they doing it?

I use iOS with Keepass1. Not sure how you can do it with Keepass2 without converting the thing over and over.

Not sure what you mean by 'converting over and over' but MiniKeePass on iOS supports both 1.x and 2.x file formats. You do have to import the file from dropbox manually, however.

Re: On Password Managers

#150

Post by [deleted] »

jrowley wrote: post #18
tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

Lastpass doesn't necessarily have the best track record, and you said you couldn't go into detail, but I'm curious so will ask - if you feel comfortable sharing, what securities issues do you see with lastpass besides storing secrets in some companies cloud?

[deleted]
Post reply on HN