Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass: OpenSource Password Manager

keepass.info

Post reply on HN
Print view View original

111–120 of 138 posts

Re: KeePass: OpenSource Password Manager

#111

Post by VexXtreme »

hughc wrote: post #80
Mitt wrote: post #22

I put a tiny Truecrypt container on my file hoster (HiDrive, Skydrive, Dropbox, etc.) in which I store the KeePass keystore. The keystore itself can't get decrypted, but in case AES has weaknesses one first needs to crack the triple encryption of AES+Serpent+Twofish of the Truecrypt container.

You've added another dependency into the mix here. I've been comfortable storing my database in Dropbox, with a decent length master password (15char+) on the assumption that it uses a high quality hash that would make bruteforcing the encryption impractical, without having to add another layer of encryption above it. Curious if others feel this is a reasonable assumption?

I do the same. 20+ character master password and Dropbox. Not worried at all.

Re: KeePass: OpenSource Password Manager

#112

Post by revasm »

ghoul2 wrote: post #94

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to…

> the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs.

Consider encrypting the filenames with Fuse+EncFS. This flaw is pretty huge elsewise; it's why I changed to using gnupg.vim+SublimeGPG.

Re: KeePass: OpenSource Password Manager

#114

Post by ghoul2 »

revasm wrote: post #112
ghoul2 wrote: post #94

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to…

> the passwords themselves would still be gpg encrypted, thus safe, but the repository will leak names of all websites and userIDs. Consider encrypting the filenames with Fuse+EncFS. This flaw is pretty huge elsewise; it's why I changed to using gnupg.vim+SublimeGPG.

I went with using a small truecrypt volume mounted at .password-store.

Re: KeePass: OpenSource Password Manager

#115

Post by SideburnsOfDoom »

jwcrux wrote: post #44
da_n wrote: post #38

The only problems I have with KeePass are it is Windows-first (though I know there are third part native clients for Linux, OS X, Android etc) and that browser integration is not comparable to something like LastPass. I do want to get away from LastPass as my trust in the cloud (especially US based cloud services) took a dive after Snowdon.

Except that Lastpass doesn't know your passwords. Everything is encrypted before it is sent to Lastpass using a password you control.

"sent to Lastpass" is enough to disqualify it for me.

http://www.techdirt.com/articles/20130620/15390323549/nsa-ha...

Re: KeePass: OpenSource Password Manager

#116

Post by hanru »

ghoul2 wrote: post #94

I have tried pretty much every one of the well known password managers (that are open source and work on linux), but never found any of them very convenient to use. Until I came across this: http://www.zx2c4.com/projects/password-store/ It is simply the easiest, most intuitive password manager out there. One of those things that, once you come across them, you wonder why it took so long for something this logical to…

Looks interesting and geeky. Will definitely try this someday. Thanks for the recommendation.

Re: KeePass: OpenSource Password Manager

#117

Post by hyyypr »

(Disclaimer: I work for Dashlane). I am sad and curious about the fact that nobody mentions Dashlane here. Is it because you guys never heard of it? Or something else ?

I realize KeePass has they key advantage of being open source, but we have good UX :)

Very interested in your thoughts...

Re: KeePass: OpenSource Password Manager

#118

Post by csmithuk »

hyyypr wrote: post #117

(Disclaimer: I work for Dashlane). I am sad and curious about the fact that nobody mentions Dashlane here. Is it because you guys never heard of it? Or something else ? I realize KeePass has they key advantage of being open source, but we have good UX :) Very interested in your thoughts...

From my perspective, there is no source code to review so we have to trust you to have made sensible security decisions, which at least I don't.

UX isn't a big win. KeyPassX is good enough i.e. works with keyboards entirely, is open source, is reviewed, goes to extra lengths not to leave stuff floating around in RAM as well. Oh and works across all platforms I use.

Re: KeePass: OpenSource Password Manager

#119

Post by alkonaut »

Is this a desktop-only solution, i.e. no mobile? Then it is bound to be a no-go for most users. My checklist is pretty short:

1. Clients available on web and/or all platforms, must be able to add/copy to clipboard passwords on all platforms. 2. Synced or Shared database between all clients. 3. No subscription cost (upfront cost OK).

Nice-to-have things would be browser plugins, command line interface etc., but that isn't essential.

Re: KeePass: OpenSource Password Manager

#120

Post by rat87 »

abrussak wrote: post #86
dewiz wrote: post #2

I'm quite surprised to see this on HN homepage, I mean this is such a great and popular tool that I would expect everyone to know about it and find it just an obvious link not to upvote. Does anyone know if there is a lib to read and write into keepass archives programmatically, e.g. from a C# app? that would be quite useful to manage in an automated way some credentials for production systems, sharing tha archive vi…

This may work: http://keepass.info/help/v2_dev/scr_index.html

The first link in that link describes a flexible command line you can use for a number of operations. The second describes how you can write c# like script files that will be loaded. Both require the KPScript extension. Why not just bundle/reference keepass.exe since its a .net executable? see http://stackoverflow.com/a/9028433/259130 . Also if you haven't tried it yet you might want to try messing about with https://www.linqpad.net/ (run c# as script file/interactively) like he did.
Post reply on HN