Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.2.0 released with YubiKey and TOTP support

keepassxc.org

Post reply on HN
Print view View original

121–130 of 132 posts

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#121

Post by angelsl »

phoerious wrote: post #85
angelsl wrote: post #49

Earlier quoted context omitted.

That would be me. I wrote the patch against the original KeePassX which seems to be no longer maintained (?). One of the KeePassXC guys asked me to rebase it over so I did. Then we (they) spent a week or two debating on how to support libargon2 and the newer libgcrypt required for ChaCha20, coming to no resolution, and I just lost any motivation to push for them to merge my patch. They also disagreed with the way I i…

KDBX4 is a priority indeed, but we only have limited resources. We hoped to get it into 2.2.0, but it just wasn't possible. We really appreciate your patch and will make sure it lands in 2.3.0. It's not forgotten.

> we only have limited resources

I understand, but I'm still disappointed. You all only needed to come to a decision on how you wanted to proceed with supporting the newer libraries required and I would have taken it from there. I'm not sure if you guys have even now come to a decision on that.

And it took a month before someone mentioned they would prefer if the KDBX 4 functionality was separated (and I do agree that it should be).

You could probably merge a similarly-sized patch into the kernel in less time...

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#122

Post by svdb_ »

phoerious wrote: post #89
svdb_ wrote: post #80

One thing I like about the KeePassX interface is the ability to search with a hotkey (CTRL+F). Also, this could be done without having the menu bar visible, hitting the hotkey just pulls up the input field.

Would you be so kind to file a feature request for that on GitHub? Thanks!

Done (#680).

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#124

Post by devcpp »

StavrosK wrote: post #100
melicerte wrote: post #67

Earlier quoted context omitted.

Have you tried the snap install ?

It makes me kind of sad that we're moving to a world where a 500 KB program gets installed in a 80 MB container :( EDIT: Wait, now it's downloading a second 80 MB container :(

Yeah, what's up with that? Is it going to download one of these every time? That's awful!

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#125

Post by justryry »

YaraGreyjoy wrote: post #106
droidmonkey wrote: post #12

Earlier quoted context omitted.

KeePass is the original, and also not very cross-platform. KeePassX has gone through several iterations and now represents a fairly stable and low-feature release of KeePass with cross-platform support. KeePassXC is where all the new and exciting features are being integrated into KeePassX while fixing latent bugs and cross-platform issues. Hope that makes sense.

Is there any thought to merging efforts with the original KeePass project? I know it's C# based but with .NET Core being an option now, maybe it doesn't require Mono and could be made cross-platform. Or maybe keep the C++ code and fold it back into the original project? I just hate to have multiple projects spend resources on what is essentially the same thing. I think there are gains to be had by combining resources…

The larger problem on cross-platform KeePass was never Mono directly (aside from the FUD), but rather the WinForms UI. One could blame Mono for not having a visually pleasing implementation of WinForms, although .NET core has nothing at all.

Refactoring out a core and building multiple UIs would be an interesting and large project.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#126

Post by tscs37 »

th3zero wrote: post #59
problems wrote: post #44

Earlier quoted context omitted.

For anyone wondering - the TOTP 2FA is not on the password wallet itself, but that the wallet is able to store the TOTP key, authenticating TOTP involves knowing the key, by which point there's really no value in using it to authenticate the wallet, it'd be a UI-only protection. However I think storing TOTP keys in your wallet is a bad idea for security - now if someone hacks your machine they get both your password…

Just to make sure no one gets the wrong impression: You should store your TOTP keys in a different KDBX file, locked with a different master password, and maybe even used on a different device/PC. We all know that you shouldn't store your password along with TOTP secrets, or should I make a blog post explaining this?

I store them in the same password safe for quite a simple reason; more convenient and less complexity.

I personally see TOTP only as a security against phishing and password stealing attacks. I don't see how a separate database for TOTP secrets improves on that in any way.

The thing is; a Keepass Password is (usually, looking at your password requirements Paypal) fairly secure in of itself, long, random and contains all the good characters.

TOTP is mainly useful when you have weak passwords and enter them into the wrong place, something that Keepass (especially with the Browser Extension) fully prevents. It's just for show and some extra padding.

Though I do use U2F anywhere I can.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#127

Post by varjolintu »

epistasis wrote: post #120
finchisko wrote: post #48

Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too. My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently workin…

Have you considered dual browser extensions as in this paper: https://arxiv.org/abs/1706.05085 >The prototype Horcrux client, implemented as a Firefox add-on, is split into two components, with code that has access to the user's master's password and any key material isolated into a small auditable component, separate from the complexity of managing the user interface.

Interesting idea. Gotta read the paper. Thank you.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#128

Post by varjolintu »

gaia wrote: post #114
varjolintu wrote: post #101

Earlier quoted context omitted.

keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currentl…

chromeIPass' possible vulnerabilities being?

Also, any autofilling is disabled by default.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#129

Post by ConfucianNardin »

danjoc wrote: post #109
Chaebixi wrote: post #103

Can someone explain how the YubiKey and TOTP support is supposed to work? I can't think of a way those could work with a local password manager like KeePass.

Reading it, it sounds like they use HMAC challenge response for the password to the vault. For that to work, you'd insert yubikey, enter a password, and the password is passed through the yubikey and hashed. The hash is then used as the password to open/lock the vault. That gives you a reasonably strong password for the vault. It does not prevent phishing. Therefore, anyone with the hash and access to the vault can s…

pass no longer uses pwgen as of version 1.7, by the way (changed in 639c46a342466209e9b0600c2b3574bb44a0ff31).

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#130

Post by phoerious »

angelsl wrote: post #121
phoerious wrote: post #85

Earlier quoted context omitted.

KDBX4 is a priority indeed, but we only have limited resources. We hoped to get it into 2.2.0, but it just wasn't possible. We really appreciate your patch and will make sure it lands in 2.3.0. It's not forgotten.

> we only have limited resources I understand, but I'm still disappointed. You all only needed to come to a decision on how you wanted to proceed with supporting the newer libraries required and I would have taken it from there. I'm not sure if you guys have even now come to a decision on that. And it took a month before someone mentioned they would prefer if the KDBX 4 functionality was separated (and I do agree tha…

I thought we settled on the PPA approach.
Post reply on HN