Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.3.0 released

keepassxc.org

Post reply on HN
Print view View original

41–50 of 105 posts

Re: KeePassXC 2.3.0 released

#41

Post by scrollaway »

zouhair wrote: post #40
scrollaway wrote: post #27

Since it got a lot of positive attention last time, here's a rough guide on getting started with password management, aimed at readers here who are not currently using a password manager: https://leclan.ch/password-managers/ TLDR: Download KeepassXC and start using it. :)

What does it do that Keepass/KeepassX cannot do? I looked at their website and nothing new shows up.

I address that at the bottom of my post. Keepass is the original, KeepassX is the Qt rewrite.

KeepassXC got Qt 5 support, a bunch of misc QOL improvement patches, is actively maintained (unlike KeepassX) and also received some nice extra features such as TOTP 2FA support. It's a superset of KeepassX, so there's no real reason to use KeepassX at this point.

Re: KeePassXC 2.3.0 released

#42

Post by JamesCoyne »

scrollaway wrote: post #28
JamesCoyne wrote: post #25

Anybody have thoughts about where to store the encrypted database for backup? Would it be foolish to keep the database somewhere publicly accessible?

It's not ideal for your encrypted db to leak because, should you mistakenly leak your master password (which can happen simply through a keylogger for example), all the contents are now at risk. However, something like Google Drive is fine. Trust Google engineers to secure your data. Dropbox also fine if you don't like Google.

This makes sense. Presently my database lives on dropbox and is not in view of the public.

Re: KeePassXC 2.3.0 released

#43

Post by piracykills »

paulryanrogers wrote: post #15
nathan_long wrote: post #2

Anybody use this along with a non-tech significant other? How does it compare to commercial password managers in terms of usability?

Usability is too low, unapproachable for non techies. Even my somewhat technical spouse found it unusable after a few months. It could be better with good browser plugins, but then you have the same security tradeoffs as more polished services like Bitwarden or LastPass.

Wasn't it shown recently that LastPass literally downloads JS from their servers to run on specified pages for compatibility? I suppose that's good for ease of use, but pretty scary from a security tradeoffs perspective and indeed KeePassHttp doesn't require you to make any sort of tradeoff like that.

Re: KeePassXC 2.3.0 released

#44

Post by gruez »

Ajedi32 wrote: post #34
alfuananzo wrote: post #4

Is it worth to migrate from Keepass2 to this? Any interesting user experiences?

I'm strongly considering it just based on the community surrounding each project. KeePass 2 seems to still be hosted on Sourceforge, and I'm not even sure where to get a copy of the latest (non-release) version of the source. The [Sourceforge repo][1] seems to be an outdated SVN repo which was last updated in 2009, and I don't see any description of how to contribute code to the project anywhere. As a result I'm not…

source code is available at https://keepass.info/download.html (scroll down to "Other Downloads and Resources")

Re: KeePassXC 2.3.0 released

#45

Post by WorldMaker »

JamesCoyne wrote: post #25

Anybody have thoughts about where to store the encrypted database for backup? Would it be foolish to keep the database somewhere publicly accessible?

I've bounced between a number of cloud drives/sync folder services over time.

I'm currently happy with Resilio Sync, fka BitTorrent Sync. It uses peer-to-peer sync ala BitTorrent, where the only "cloud" shares are peers you build/authorize. It supports encrypted shares where some of your peer devices, such as your "cloud" share, may participate in syncing the swarm without being able to directly decrypt its contents.

https://www.resilio.com/individuals/

Re: KeePassXC 2.3.0 released

#46

Post by fauigerzigerk »

nas wrote: post #35
JamesCoyne wrote: post #25

Anybody have thoughts about where to store the encrypted database for backup? Would it be foolish to keep the database somewhere publicly accessible?

I store the .kdbx (database) file on a network synced folder (e.g. like dropbox or gdrive). However, I use a "key file" in addition to a password. The key file is not synced and remains on computers that I control. I also have a backup copy on external media.

Aren't you worried about that fact that any program you run could potentially read all your passwords using the key file?

Re: KeePassXC 2.3.0 released

#47

Post by laurent123456 »

minimaxir wrote: post #5

Previous thread about KeepPassXC 2.2.0: https://news.ycombinator.com/item?id=14633576 I used KeePassXC for a period, but from these release notes, the UI/UX still isn't great. If you're on macOS, I recommend MacPass, which feels more native to the system, is compatible with existing KBDX databases and most-importantly, is also open-source: https://github.com/MacPass/MacPass

Also macPass is compatible with Keepass database 1.0, unlike KeepassXC.

Re: KeePassXC 2.3.0 released

#49

Post by awill »

I was a longtime user of KeePassX. The UI was terrible, but it was free, open source and most importantly cross platform. After KeePass2 made the DB incompatible and rewrote everything in C# it stopped being a proper cross platform product and I investigated aternatices. I've since moved to enpass and I'm very happy. Enpass is a great, native app on Win/Mac/Linux and has native Android/iOS apps (with fingerprint support etc..). Great UI, no subscription fees, no cloud hosting (though it syncs to your personal dropbox, gDrive, OwnCLoud etc..). I couldn't ask for more.

Re: KeePassXC 2.3.0 released

#50

Post by drdaeman »

xylia wrote: post #31
bdz wrote: post #30

Is it worth moving to this from 1Password? I mean I don't have any problems at all tho I use an old version (6 on Mac, 4 on Win), the permanent license version not this new subscription. I was thinking to use this with Dropbox, Chrome, and iOS client (MiniKeePass?)

I suggest using Bitwarden (open source) instead. See my article: https://greycoder.com/bitwarden-excellent-free-password-mana...

The linked article is very light on details to be called a comparison.

Let me try to make it a little bit more detailed.

====================

Bitwarden:

- Is essentially a service (with FLOSS client software and FLOSS server code).

- Quite polished browser integration (to the extent browsers allow it).

- Third party server holding the encrypted data. Proprietary (in a "completely unique, not compatible with anything else" sense) sync protocol.

- Symmetric encryption key is encrypted with master key but it is NOT changed (with re-encrypting all the entries) when master password is changed. I'm not sure if there is an option to re-encrypt the data in case the symmetric key is compromised, although this should be doable via APIs.

- Data is encrypted and signed, but some of the data structure (folder layout, TOTP existence, revision dates) is (theoretically) accessible to the service owners. Check out snippets at https://github.com/jcs/bitwarden-ruby/blob/master/API.md for info.

- Has some nice extras built-in, like domain equivalence logic.

- Self-hosted option is available (official Docker images using .NET Core and Microsoft SQL Server and unofficial third-party implementation in Ruby). I'm not sure how this works with licensing.

====================

Keepass:

- Is primarily a standalone application. Or, better say, applications, as there are multiple independent implementations for many platforms.

- Has browser integration, but all options (KeepassXC-Browser and PassIFox) are feel somewhat less polished.

- Has composite credentials (in addition or instead of master password it can use i.e. keyfiles). Supported mechanisms vary with implementation.

- If the encryption keys are compromised you can trivially re-encrypt the database to avoid further leaks.

- File format is essentially a large encrypted and signed XML file (data block) with some extensible header that defines the crypto details. https://keepass.info/help/kb/kdbx_4.html

- You handle the sync however you want it. For KeepassXC you need make database available in a filesystem. For Keepass and Android app there are also SFTP, WebDAV, Dropbox, Google Drive and some other options available. The only sync that's in the app is a logic for merging databases.

====================

Please correct me if I got something wrong. Thanks.

Post reply on HN