Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.2.0 released with YubiKey and TOTP support

keepassxc.org

Post reply on HN
Print view View original

101–110 of 132 posts

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#101

Post by varjolintu »

Quiark wrote: post #99
finchisko wrote: post #48

Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too. My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently workin…

A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al

keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page.

I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currently if there's any vulnerabilities, these are almost identical to chromeIPass' possible vulnerabilities.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#102

Post by nirvdrum »

rovr138 wrote: post #97
nirvdrum wrote: post #91

Earlier quoted context omitted.

Sorry to hijack the thread a bit, but since you're discussing the snap install I thought I'd ask. This is the first snap app I've ever used. I find the file browser for opening the DB won't show anything outside of my $HOME. I assume this is some sort of sandbox feature of snap apps. But I'd like to store my DB on a network mount, so that gets in the way unless I set up symlinks. Is there any way to get this to behav…

It is because of a sandbox feature. You can't easily disable it right now. I would try the symlink approach for now. Possibly drop a file next to the DB on your share in case you have to do it again and don't remember.

Thanks for confirming. I'll string something together.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#104

Post by punjabisingh »

Androider wrote: post #98
underlines wrote: post #25

Earlier quoted context omitted.

I just wait for Android O Autofill Framework to arrive. Then mobile password managers will finally be useful.

Interesting, how will it be better? The Lastpass for Android autofill in both native apps and web is already pretty perfect in my experience, it detects the fields and fills in the login. In the very rare case it doesn't, the notification list will have a one-click entry to force-fill the info.

It's not perfect. It is slow because it uses Android's accessibility service to detect fields.

Ref: https://lastpass.com/support.php?cmd=showfaq&id=8166

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#105

Post by rodorgas »

angelsl wrote: post #49
problems wrote: post #43

Still no KDBX 4 support though? Please consider making it a priority - it looks like someone tried to pull request it but that failed? The older format uses a custom AES-based KDF - and while I don't personally see any major issues with it, I'm much more comfortable with the modern, heavily reviewed Argon2 design used in the KDBX4. https://github.com/keepassxreboot/keepassxc/issues/148

That would be me. I wrote the patch against the original KeePassX which seems to be no longer maintained (?). One of the KeePassXC guys asked me to rebase it over so I did. Then we (they) spent a week or two debating on how to support libargon2 and the newer libgcrypt required for ChaCha20, coming to no resolution, and I just lost any motivation to push for them to merge my patch. They also disagreed with the way I i…

Congrats for your work there. It's sad that they asked you to refactor before raising the separated class issue.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#106

Post by YaraGreyjoy »

droidmonkey wrote: post #12
sillysaurus3 wrote: post #6

So there's KeePass, KeePassX, and now KeePassXC? (And two different variants of KeePass that have nothing to do with each other.) Not that there's anything wrong with that. I'm just curious if KeePassXC is yet another fork, or if it's from the same people who did KeePassX. KeePassX has an excellent security reputation, so it'd suck if an unrelated fork ruined that.

KeePass is the original, and also not very cross-platform. KeePassX has gone through several iterations and now represents a fairly stable and low-feature release of KeePass with cross-platform support. KeePassXC is where all the new and exciting features are being integrated into KeePassX while fixing latent bugs and cross-platform issues. Hope that makes sense.

Is there any thought to merging efforts with the original KeePass project? I know it's C# based but with .NET Core being an option now, maybe it doesn't require Mono and could be made cross-platform. Or maybe keep the C++ code and fold it back into the original project?

I just hate to have multiple projects spend resources on what is essentially the same thing. I think there are gains to be had by combining resources together.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#107

Post by sillysaurus3 »

varjolintu wrote: post #101
Quiark wrote: post #99

Earlier quoted context omitted.

A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al

keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currentl…

Well, yes, that's the goal. But it's surprisingly easy to mess up. I think the people here are cautioning you not to get overconfident, and to make sure you research the details of the flaws in other systems.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#108

Post by atomlib »

mynegation wrote: post #15
atomlib wrote: post #14

I see it supports Linux, Windows, and macOS, but are there any Android and iOS apps to open and modifty KeePassXC databases?

If you feel like keeping your kdbx file in Dropbox you may use ikeepass[1] on iOS to load and modify it. For Android there is keepassdroid [2] [1] https://itunes.apple.com/us/app/ikeepass/id299697688?mt=8 [2] http://www.keepassdroid.com/

Thanks, I actually use Keepassdroid. However, can it open databases from KeePassXC? (Well, I guess I can check a bit later myself.)

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#109

Post by danjoc »

Chaebixi wrote: post #103

Can someone explain how the YubiKey and TOTP support is supposed to work? I can't think of a way those could work with a local password manager like KeePass.

Reading it, it sounds like they use HMAC challenge response for the password to the vault. For that to work, you'd insert yubikey, enter a password, and the password is passed through the yubikey and hashed. The hash is then used as the password to open/lock the vault. That gives you a reasonably strong password for the vault. It does not prevent phishing. Therefore, anyone with the hash and access to the vault can still access all passwords without your knowledge. The TOTP thing sounds like a google authenticator sort of feature.

I'm sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. QTPass is a nice cross platform gui client. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it.

My biggest problem these days is dealing with sites that don't allow 30+ char passwords with full range of special characters. Almost exclusively, banks.

Post reply on HN