KeePassXC 2.3.0 released • Hacker News Board

Re: KeePassXC 2.3.0 released

#11

Post by therealmarv » Wed, Feb 28, 2018, 4:32 PM UTC

is it stable again? Last version was constantly crashing when modifying a new passwort entry again. This is something which is unacceptable for a password manager IMHO.

Re: KeePassXC 2.3.0 released

#12

Post by minimaxir » Wed, Feb 28, 2018, 4:34 PM UTC

piracykills wrote: post #7

> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome. Congrats on the release.

What are the advantages/disadvantages of using Argon2/ChaCha20 over the current AES implementation? What are good parameters for those algos?

Re: KeePassXC 2.3.0 released

#13

Post by AndyMcConachie » Wed, Feb 28, 2018, 4:37 PM UTC

nathan_long wrote: post #2

Anybody use this along with a non-tech significant other? How does it compare to commercial password managers in terms of usability?

I trained my parents to use KeePassX 2.0 and they do OK with it. They're very tech non-savy but do fine with it because they only have to remember one password. I also made sure they use Timemachine for OSX so they don't lose their database. Prior to this they had a physical notebook and sticky notes with passwords written on them.

Re: KeePassXC 2.3.0 released

#14

Post by piracykills » Wed, Feb 28, 2018, 4:38 PM UTC

minimaxir wrote: post #12

piracykills wrote: post #7

> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome. Congrats on the release.

What are the advantages/disadvantages of using Argon2/ChaCha20 over the current AES implementation? What are good parameters for those algos?

Well, in my amateurish opinion - there was nothing wrong with the existing AES encryption implementation. But they also had a key derivation function based on running many iterations of AES, which was weird and non-standard, I mean it seemed like it would work, but it's not proven in the cryptographic community. Now they've switched to Argon2 which is a very well reviewed KDF and I have a lot more faith in that.

Code for the old KDF is here if anyone's interested: https://github.com/keepassxreboot/keepassxc/blob/7a55ab64d83...

Re: KeePassXC 2.3.0 released

#15

Post by paulryanrogers » Wed, Feb 28, 2018, 4:38 PM UTC

nathan_long wrote: post #2

Anybody use this along with a non-tech significant other? How does it compare to commercial password managers in terms of usability?

Usability is too low, unapproachable for non techies. Even my somewhat technical spouse found it unusable after a few months.

It could be better with good browser plugins, but then you have the same security tradeoffs as more polished services like Bitwarden or LastPass.

Re: KeePassXC 2.3.0 released

#16

Post by the_af » Wed, Feb 28, 2018, 4:40 PM UTC

codemac wrote: post #6

nathan_long wrote: post #2

Anybody use this along with a non-tech significant other? How does it compare to commercial password managers in terms of usability?

Without syncing or shared folders, I haven't tried it.

You can sync it over Dropbox or a similar service. I actually prefer it that way, since it decouples the password manager from the syncing/sharing service.

Re: KeePassXC 2.3.0 released

#17

Post by guessmyname » Wed, Feb 28, 2018, 4:43 PM UTC

piracykills wrote: post #7

> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome. Congrats on the release.

Last week I started reverse engineering the KDBX 3.1 file format (for fun).

Does anyone knows where is the specification for KDBX 4.0?

EDIT: Found it — https://github.com/keepassxreboot/keepassxc-specs

Re: KeePassXC 2.3.0 released

#18

Post by 076ae80a-3c97-4 » Wed, Feb 28, 2018, 4:44 PM UTC

I highly recommend https://keeweb.info/ if you're looking for an attractive, easy to use, cross-platform and Open Source solution. I've been using it on Windows and MacOS for years without any major issues. It's by far the best looking front-end for keepass databases I've seen.

Re: KeePassXC 2.3.0 released

#19

Post by danesparza » Wed, Feb 28, 2018, 4:47 PM UTC

guessmyname wrote: post #17

piracykills wrote: post #7

> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome. Congrats on the release.

Last week I started reverse engineering the KDBX 3.1 file format (for fun) . Does anyone knows where is the specification for KDBX 4.0? EDIT: Found it — https://github.com/keepassxreboot/keepassxc-specs

This link also talks about changes to the spec for 4.x (but in more general terms):

https://keepass.info/help/kb/kdbx_4.html

Re: KeePassXC 2.3.0 released

#20

Post by TorKlingberg » Wed, Feb 28, 2018, 4:48 PM UTC

I currently use KeePass2 + Dropbox + Kee (Firefox) + MiniKeePass (iOS). Can KeePassXC + plugins replace those, and what are the advantages?