Live data from Hacker News

KeePassXC 2.6.1

keepassxc.org

101–110 of 119 posts

Re: KeePassXC 2.6.1

#101
post #77

Earlier quoted context omitted.

Your database is encrypted by default. Additional encryption won't hurt, of course, but you can absolutely use Dropbox.

Right, I guess my concern was a brute force attack on a DB file if it fell into the wrong hands. I looked at the main website again though, and apparently the official Windows app has some protection against this. It says however, KeypassX (and I assume therefore KeypassXC) does not have the same level of protection. Another comment mentioned using a key-file, so maybe I will revisit that approach, since I used passw…

To prevent brute force attack, you should choose long enough password and adjust iterations parameter on Key transformation. Basically more iterations = more time to brute force, but your application will spend more time opening the database. Longer password = less likely for brute force to succeed.

For me 12 characters password with default 60 000 iterations seems safe enough. My estimation is that it would take at least millions of dollars to break it and my passwords are not worthy of that. You can easily make it into unbreakable for a foreseeable future by using something like 16-characters random password and 10 millions of iterations.

Key file of enough length is like an unbreakable password. But you probably can't remember it, so be careful not to lose it. My database is accessible on public URL which I remember and I remember my password, so I can always download it anywhere and open it. I think that it's a big advantage and I wouldn't want to lose it.

Re: KeePassXC 2.6.1

#102

Earlier quoted context omitted.

It has worked for me perfectly for quite a long time. All my personal documents and photos are synced between an Android phone, my RPi 4 and my laptop. I haven't touched the settings for years. It just always works, 100% perfectly. I don't understand why it isn't more popular.

"First, you'll want to set up a server" and you're already down to well under 1% of the population that'll be interested in reading any further, let alone following through and actually doing it.

I doubt the OP intended to ask why it wasn't popular among the general population. That seems obvious. I would interpret his question as asking why it's not more popular even among the subset of people who are happy to run their own servers, like readers of this very board.

Re: KeePassXC 2.6.1

#103
post #62

Earlier quoted context omitted.

I'm not sure I follow. Browser extensions aren't simulating keyboard strokes, so they absolutely would save you in that case.

You assume that any malware that is in a position to log keyboard and clipboard events is somehow not in a position to do things like install its own trusted certificate, perform dll injection, or otherwise intercept the password anyway. Not to mention that with all the other things it has access to it might not need said password to fuck up your life. Its a poor argument for choosing browser extensions over cut & pa…

> Its a poor argument for choosing browser extensions over cut & paste because the circumstances where it has an advantage are incredibly specific.

I agree that malware that has that power could do something else, but the parent post incorrectly asserted that the specific attack of keylogging would work, which it doesn't. I wasn't arguing that as the reason to use them over copy/paste.

The main thing extensions save you from is phishing attacks because they verify the origin of the page is correct for the entry, which is a really common attack and a hard thing for humans to verify consistently, and doesn't require any malware on your machine.

Re: KeePassXC 2.6.1

#105
post #77

Earlier quoted context omitted.

Right, I guess my concern was a brute force attack on a DB file if it fell into the wrong hands. I looked at the main website again though, and apparently the official Windows app has some protection against this. It says however, KeypassX (and I assume therefore KeypassXC) does not have the same level of protection. Another comment mentioned using a key-file, so maybe I will revisit that approach, since I used passw…

To prevent brute force attack, you should choose long enough password and adjust iterations parameter on Key transformation. Basically more iterations = more time to brute force, but your application will spend more time opening the database. Longer password = less likely for brute force to succeed. For me 12 characters password with default 60 000 iterations seems safe enough. My estimation is that it would take at…

Great, Thanks for the advice!

When I decided to start using a password manager, I was drawn to Keypass since it is open source and I don't have to rely on any third party service. But learning how to use it correctly, and juggle your db files among all your devices requires a sound, thought out strategy!

Re: KeePassXC 2.6.1

#106
post #82

Earlier quoted context omitted.

I currently only use a password/phrase, but I will consider using a key file as well. My concern was a brute force attack on a compromised DB file. But I guess as long as the key-file was never put in the cloud, this would alleviate that concern?

Yes, when you want to use a new device you sideload the key file onto it in a secure manner (i.e. USB). On Android this presents some issues though, since the last I checked the keyfile had to be added to the "SD Card" class storage, which other apps can also access. If you are on android and go this route, be really careful about the types of apps you install that have Storage permissions (good advice in general, of…

Good points. I used to use Android, but recently switched to iOS, mostly because I have a Macbook pro and iMac.

I'm not blown away by the iPhone in general honestly, but being able to sync everything between the Mac devices is super convenient. The ability to easily share files wireless-ly between all of them via Airdrop is fantastic. Great use cae for moving KBDX files, or in this case key-files is super useful.

Re: KeePassXC 2.6.1

#107
Can anyone tell me which Keepass they recommend?

There's so many different Keepasses...

I'd like to use the same db file between Windows, Linux and Android, and I'd like to be able to autoenter without a browser plugin, at least on Windows.

Re: KeePassXC 2.6.1

#108

Can anyone tell me which Keepass they recommend? There's so many different Keepasses... I'd like to use the same db file between Windows, Linux and Android, and I'd like to be able to autoenter without a browser plugin, at least on Windows.

I believe this one, KeePassXC, is the most-recommended one.

Re: KeePassXC 2.6.1

#109

Can anyone tell me which Keepass they recommend? There's so many different Keepasses... I'd like to use the same db file between Windows, Linux and Android, and I'd like to be able to autoenter without a browser plugin, at least on Windows.

I believe this one, KeePassXC, is the most-recommended one.

Is the db format standard - ie can I sync the same file between Android/Linux and KeePassXC and use it in all of them?

Re: KeePassXC 2.6.1

#110
post #46

Earlier quoted context omitted.

Syncthing is a nice alternative to Dropbox. If you use multiple computers at different locations, you could, say, use Syncthing to sync your KeepassXC database between your home computer and your phone, and between your phone and your work computer, without it ever touching a third party service.

It has worked for me perfectly for quite a long time. All my personal documents and photos are synced between an Android phone, my RPi 4 and my laptop. I haven't touched the settings for years. It just always works, 100% perfectly. I don't understand why it isn't more popular.

:-) And now I have another "for the family" project. Thanks, I think...
Post reply on HN