Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass: OpenSource Password Manager

keepass.info

Post reply on HN
Print view View original

131–138 of 138 posts

Re: KeePass: OpenSource Password Manager

#131

Post by goodside »

ScottWhigham wrote: post #126
goodside wrote: post #28

I recommend OneShallPass ( http://oneshallpass.com ) over KeePass. It's open source and auditable like KeePass, but: 1) It doesn't have to be compiled or installed, since it's just a monolithic HTML page with all JS/CSS inline. 2) It has a free, optional hosted service that stores encrypted passwords with pure client-side decryption, so you can get your passwords from any web-enabled device without having to trust th…

1) It doesn't have to be compiled or installed, since it's just a monolithic HTML page with all JS/CSS inline. The obvious and huge difference then would be that KeePass requires a password or key file to open but an HTML page requires only a browser or text editor. Major, major difference to me.

> The obvious and huge difference then would be that KeePass requires a password or key file to open but an HTML page requires only a browser or text editor. Major, major difference to me.

Did you spend even two seconds looking at OneShallPass? Literally the second thing on the page is a field asking for a passphrase, and yet you came here to complain that it doesn't require a passphrase.

The passwords are encrypted. The fact you can read the decryption algorithm in your text editor doesn't let anyone know your passwords, any more than you being able to download and read the source of KeePass lets you read other people's KeePass passwords.

Re: KeePass: OpenSource Password Manager

#132

Post by jrabone »

Really want to start using KeePass on Android with an NFC token, but it looks like the YubiKey Neo might get a new version soon to support U2F. Anyone know if the U2F thing is worth waiting for? Don't want to spend $50 (probably £50) to find it's obsolete next week.

Re: KeePass: OpenSource Password Manager

#133

Post by jcculb »

hughc wrote: post #80
Mitt wrote: post #22

I put a tiny Truecrypt container on my file hoster (HiDrive, Skydrive, Dropbox, etc.) in which I store the KeePass keystore. The keystore itself can't get decrypted, but in case AES has weaknesses one first needs to crack the triple encryption of AES+Serpent+Twofish of the Truecrypt container.

You've added another dependency into the mix here. I've been comfortable storing my database in Dropbox, with a decent length master password (15char+) on the assumption that it uses a high quality hash that would make bruteforcing the encryption impractical, without having to add another layer of encryption above it. Curious if others feel this is a reasonable assumption?

I do that and keep a Key file locally off Dropbox. The combination should be pretty secure.

Re: KeePass: OpenSource Password Manager

#134

Post by AceJohnny2 »

jlgaddis wrote: post #48
AceJohnny2 wrote: post #34

I've been having it on my various systems (Windows, Linux, Android) in the sidelines for a couple months, and after initial fiddling, still haven't actually started using it. This is mostly because I don't want to have to deal with copy-pasting my password between the KeePass app and the browser (where most of my passwords are needed). Luckily, there are autofill plugins that exist for Chrome [1], Firefox [2], and An…

For personal use, I've been using LastPass for a few years but have been slowly migrating away from it in recent months. I'm switching to KeePassX which I already use for $work-related data. (I have intentionally avoided the Mono-based applications.) KeePassX has similar "auto-fill" functionality as well. It's not as perfect or as seamless as LastPass but it is definitely usable (after a bit of one-time per-site twea…

I looked into LastPass last week. It looked great on desktops, but on Android it's basically a separate browser. That's a no-go for me, I'd rather stick with Chrome

Re: KeePass: OpenSource Password Manager

#135

Post by _fs »

ghoul2 wrote: post #109
ygra wrote: post #103

Earlier quoted context omitted.

I think just pressing a hotkey to auto-type the correct password and username based on the currently active web page, program, window, etc. is easier still than opening a terminal and running a command. To me at least.

Well, I always have guake running, so for me doing it all on the command-line is WAY faster and more convenient. I forgot to mention that "pass" also has command line completion - which makes retrieval trivial. I would also be surprised if someone somewhere hasn't already written an "autotype" layer over pass, but thats not something I am personally interested in. I do agree that for end users this may not be the cas…

I fail to understand how typing anything on the command line would be faster then a single shortcut (cmd + \).

Re: KeePass: OpenSource Password Manager

#136

Post by weland »

ygra wrote: post #123
weland wrote: post #106

Earlier quoted context omitted.

Unfortunately, that's useless if you need to store passwords for anything other than web use, if you need to automate the entering of passwords and so on.

I routinely use it for entering passwords to SSH or RDP sessions, and various other non-web passwords. Why would auto-type work only on the web anyway? You can also customise how the password is entered depending on where you invoke auto-type, e.g. if you need username/password, separated with a tab key in one place, but only the password in another.

Oh, I didn't know that. Sorry!

Re: KeePass: OpenSource Password Manager

#137

Post by brownbat »

borplk wrote: post #108
brownbat wrote: post #72

I use a password locker. It makes me wish there was an open standard for sites to negotiate a new entry with a password manager, something automatic in the background for new registrations. Site could send password restrictions, like allowed and required character types, minimum length, even maximum length, though that last one would be frowned upon. The locker would reply with a preferred username and random passwor…

God damn what you mentioned is a brilliant idea. I wish there was some standard for it. These are problems that I'm often inclined to work on solving, but unfortunately they are also the kind that need lots of time and adoption and formal procedures and acceptance from a large group of people to go anywhere so I tend to just day dream about them for a little while then give up, hoping some standard body or an organiz…

Whats the barrier to an RFC? Can just anyone submit one? I'll try a writeup if anyone thinks it's worth putting out there.

Re: KeePass: OpenSource Password Manager

#138

Post by borplk »

brownbat wrote: post #137
borplk wrote: post #108

Earlier quoted context omitted.

God damn what you mentioned is a brilliant idea. I wish there was some standard for it. These are problems that I'm often inclined to work on solving, but unfortunately they are also the kind that need lots of time and adoption and formal procedures and acceptance from a large group of people to go anywhere so I tend to just day dream about them for a little while then give up, hoping some standard body or an organiz…

Whats the barrier to an RFC? Can just anyone submit one? I'll try a writeup if anyone thinks it's worth putting out there.

I don't think there's any significant barrier to publishing it (probably no barrier at all). But my perception is everything comes after that ... this kind of stuff tends to be very slow moving.
Post reply on HN