Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass: OpenSource Password Manager

keepass.info

Post reply on HN
Print view View original

91–100 of 138 posts

Re: KeePass: OpenSource Password Manager

#91

Post by tzs »

If I may, I have a question that was inspired by using password managers.

Does anyone see any security issues with supporting on a website allowing the user name and password to be entered together in one field? The normal way of entering the user name into one field and the password into another would continue to work. The site would simply check and if the user name field content is blank, and the password field content has a space in it, the password field content will be assumed to actually be the user name and password together, separated by a space.

The idea here is that you'd then be able to enter both the user name and the password with a single copy/paste operation. This would be convenient when using a password manager on an iPad. I sometimes get tired of having to do this:

1. unlock password manager

2. copy user name

3. switch to browser

4. paste user name

5. switch back to password manager

(If using most paranoid security settings, insert another step of "unlock password manager")

6. copy password

7. switch to browser

8. paste password

If the website supported my single-field option, I could just set the password manager to stop the computer user name and password is the password field, and then it is only unlock/copy/switch/paste.

Re: KeePass: OpenSource Password Manager

#92

Post by mwww »

tzs wrote: post #91

If I may, I have a question that was inspired by using password managers. Does anyone see any security issues with supporting on a website allowing the user name and password to be entered together in one field? The normal way of entering the user name into one field and the password into another would continue to work. The site would simply check and if the user name field content is blank, and the password field co…

I believe that instead of messing around with a known standard (username + password fields), it would be better if web services would implement two-factor authentication. Password managers would become useless then, because you would be able to use simple passwords that you may remember, while being even more secure.

Re: KeePass: OpenSource Password Manager

#93

Post by kriro »

I have been using it since version 1. Unfortunately I have upgraded to KP2 which can't easily export/import to KeePassX which is what I want to switch to, mostly because I very rarely use Windows these days and when I do I don't really need my PW-DB.

I'm syncing it via ownCloud for as a testrun (https, non-US site) and it works fine. Not sure I ultimately want to do that via the cloud though. Might just switch to using a USB stick especially since merging DBs works pretty well.

Re: KeePass: OpenSource Password Manager

#94

Post by ghoul2 »

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use.

Until I came across this: http://www.zx2c4.com/projects/password-store/

It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to come into existence. I am not associated with the project, but these are just a few things I love about "pass"

1. Command-line based: which means I can script it, I can run it remotely, etc.

2. Uses Git to store the passwords: full revision history, changelog, and remote push/sync features that git is SO good at. Other password managers have to reinvent that whole wheel and none seems to do a good job. This also eliminates the need for "hosted" solutions - which I just simply refuse to use.

3. GPG for password encryption: once again, such a natural, awesome way to do things. GPG is already the safest way practical way to secure data-at-rest. I can rest easy that no silly homegrown encryption system was invented. Also, as long as I have the keys, in the worst case I can do the decryption myself, if I do not have access to "pass".

The only thing I believe it might lack is the fact that the names of the entries are in the clear. Which means I cannot setup a github(private) repository as remote for my pass store: the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs.

In anycase, kudos and thanks to the devs!

Re: KeePass: OpenSource Password Manager

#95

Post by jlgaddis »

LocalPCGuy wrote: post #62
jlgaddis wrote: post #48

Earlier quoted context omitted.

For personal use, I've been using LastPass for a few years but have been slowly migrating away from it in recent months. I'm switching to KeePassX which I already use for $work-related data. (I have intentionally avoided the Mono-based applications.) KeePassX has similar "auto-fill" functionality as well. It's not as perfect or as seamless as LastPass but it is definitely usable (after a bit of one-time per-site twea…

As others have said, why migrating away from LastPass? They definitely seem to be doing things properly in terms of security and I've been very happy with the security, as well as the ease of use when I set it up on a new machine.

I have the LastPass plugin installed in Firefox, which I use 95% of the time. I also have the mobile app installed on my iPhone.

Why the switch? Recent revelations WRT NSA & the iPhone, recent reports of other plugin developers selling their plugins to shady actors, and my general belief that the most sensitive credentials I have are safer on machines under my control instead of "in the cloud".

I work for an ISP and also manage systems and networks for schools, government organizations, health care facilities, investment firms, law offices, you name it. If someone were to gain access to all of my stored credentials, they could do a LOT of damage -- to myself as well as many, many others.

While I have no reason to believe that there's anything wrong with LastPass (from a security point of view), I am certain that the level of risk is lower with, i.e., KeePassX.

Re: KeePass: OpenSource Password Manager

#96

Post by jlgaddis »

esMazer wrote: post #59
Goopplesoft wrote: post #55

Earlier quoted context omitted.

> I've been using LastPass for a few years but have been slowly migrating away from it in recent months. LastPass user here, wondering why?

same here, why?

(copy/pasted from a sibling reply)

I have the LastPass plugin installed in Firefox, which I use 95% of the time. I also have the mobile app installed on my iPhone.

Why the switch? Recent revelations WRT NSA & the iPhone, recent reports of other plugin developers selling their plugins to shady actors, and my general belief that the most sensitive credentials I have are safer on machines under my control instead of "in the cloud".

I work for an ISP and also manage systems and networks for schools, government organizations, health care facilities, investment firms, law offices, you name it. If someone were to gain access to all of my stored credentials, they could do a LOT of damage -- to myself as well as many, many others.

While I have no reason to believe that there's anything wrong with LastPass (from a security point of view), I am certain that the level of risk is lower with, i.e., KeePassX.

Re: KeePass: OpenSource Password Manager

#97

Post by mrsteveman1 »

ghoul2 wrote: post #94

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to…

Indeed, I love pass. I found that the majority of the time, typing 'pass ' is faster than clicking through a GUI anyway, and far more convenient if I'm already in the terminal.

And on the web, all the other password managers have browser extensions to autofill data from their own database, but every common browser already does password storage and autofill natively. So once I grab a password from pass the browser remembers it anyway, making extensions unnecessary.

Oh, and the other thing I LOVE about pass is that because it uses GPG, the key encrypting all the data can be held in a nice portable smartcard, since GPG supports them directly, and it all just works when my smartcard is plugged in. I use a yubikey neo with openpgpcard applet for this and it's been great.

I did start writing an OS X dropdown menu for accessing my passwords from pass, but I haven't been in such a hurry to get it done because it doesn't seem all that necessary in practice :)

Re: KeePass: OpenSource Password Manager

#98

Post by cyphax »

kriro wrote: post #93

I have been using it since version 1. Unfortunately I have upgraded to KP2 which can't easily export/import to KeePassX which is what I want to switch to, mostly because I very rarely use Windows these days and when I do I don't really need my PW-DB. I'm syncing it via ownCloud for as a testrun (https, non-US site) and it works fine. Not sure I ultimately want to do that via the cloud though. Might just switch to usi…

I have this problem as well. For some reason KeePass 2.x (Windows, at work) cannot read KeePass 1.x databases and KeePassX on my Linux computer at home. So if I want to exchange between the 2, I have export from KeePass 2.x, so now I have 2 databases that are generally in sync, until I forget to export it. So not ideal. I'm considering switching from KeePass 2.x to KeePass 1.x (currently 1.26, released in July of last year, so not too old) but I wish these applications would get their compatibility on the same level.

edit: I wasn't sure if KeePassX had a Windows port -- it does and I downloaded it to replace KeePass at work with.

Re: KeePass: OpenSource Password Manager

#99

Post by BorisMelnik »

ghoul2 wrote: post #94

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to…

you make some really good points, as a programmer/scripter but for most end users and consumers they need something intuitive and keeppass is just that. personally I've used roboform now for over 5 years and have never been so happy to pay a yearly subscription fee. stores notes/passwords etc.

Re: KeePass: OpenSource Password Manager

#100

Post by sushirain »

gibybo wrote: post #40

For those looking for something ultra lightweight, I highly recommend pwdhash ( http://pwdhash.com ). It's not a password manager, it's just an open source hashing algorithm that protects you from sites storing your password poorly. Instead of depending on them to store your password in a one-way hash, it does it on your end before sending the password to the site. The algorithm is very roughly base64encode(hash(pass…

I used pwdhash for a long time, and moved to KeePass. pwdhash is less secure because:

* A site may be able to compromise the browser extension.

* You have to memorize several passwords because sites require different length passwords.

* The code has been reviewed less.

* A key-store like KeePass can store many original passwords, not just one hashed password.

* It doesn't have a non-browser app, so I had to copy paste passwords from the browser, while KeePass has Alt-Ctrl-A.

Post reply on HN