111–120 of 132 posts
Earlier quoted context omitted.
Really?... The syncing and conflict resolution (or lack thereof) is the true problem for me.
Keepass2Android works great for me syncing over OwnCloud (they have several cloud sync options)
Earlier quoted context omitted.
keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currentl…
Well, yes, that's the goal. But it's surprisingly easy to mess up. I think the people here are cautioning you not to get overconfident, and to make sure you research the details of the flaws in other systems.
This is really cool. Here are more feature requests (and for all I know they're already there): * Optionally display a secret as a QR code * Generate and validate BIP39-compatible seeds (like Diceware but with a checksum. Many Bitcoin wallets these days accept them) * Get this into Tails
Would you be so kind to file a feature request on GitHub? Here it gets lost. Thanks!
Earlier quoted context omitted.
A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al
keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currentl…
Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too. My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently workin…
A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al
With that said, what's the threat model for the first point? Is localhost interception a serious risk?
Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too. My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently workin…
I see it supports Linux, Windows, and macOS, but are there any Android and iOS apps to open and modifty KeePassXC databases?
For standard keepass I use keepass2android and nextcloud for syncing. That said I don't believe it supports any of the fun new stuff from KeepassXC. It does work with NFC and HOTP though. I'd love to use TOTP instead.
Earlier quoted context omitted.
keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currentl…
chromeIPass' possible vulnerabilities being?
Other than that, chromeIPass uses quite old libraries and depricated API functions. Those haven't been updated in ages. keepassxc-browser should fix all issues mentioned above :)
Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too. My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently workin…
https://arxiv.org/abs/1706.05085
>The prototype Horcrux client, implemented as a Firefox add-on, is split into two components, with code that has access to the user's master's password and any key material isolated into a small auditable component, separate from the complexity of managing the user interface.