I have read that the KDBX4 password database is "very secure" but am curious if any hacking challenges have been conducted to see if anyone can break it? The challenge I have in mind put some kind of contact info in an entry and then post the KDBX file on a public site for anyone to download and try to hack. If you get it open, use the info to contact the contest organizers and once you explain how you overcame the security and it's replicated you get however much has been donated as a hack bounty.
I'll put $100 in right now if the maintainers of KeePassXC are down with this.
A habit I carried over from using KeePassXC is that I don't use a browser extension. Call it paranoia but I don't want the browser process to have the ability to reach into my password manager. What I do is pin the Bitwarden tab open and just copy & paste where needed. For the desktop app it would be awesome if it had an auto-type feature like KeePassXC (something that mystifies coworkers who see that in action for t…
You're losing out on certain types of phishing protections by doing this. You're also potentially opening yourself up to any apps/tools that are keeping an eye on your clipboard if you're copying and pasting. Auto-type might help with that, but I also wouldn't hold my breath for such a feature coming.
And at the same time you win by not falling victim of "oops, there is a bug in our browser add-on that accidentally leaks arbitrary login data to websites", as it has happened in the past. Leaking all my credentials certainly sounds more concerning to me than leaking the credentials to a single page.
I switched to KeePassXC a few months ago from KeePass. The UI is quite clunky in places, but that's easier to live with than being beholden to some online service...
how is your experience in a browser? I honestly tried to use Bitwarden, paid for premium for one time key feature and browser extensions comparing to 1pass are much less convenient. For instance, an ability to manage multiple website (e.g. google) accounts is priceless
A habit I carried over from using KeePassXC is that I don't use a browser extension. Call it paranoia but I don't want the browser process to have the ability to reach into my password manager. What I do is pin the Bitwarden tab open and just copy & paste where needed. For the desktop app it would be awesome if it had an auto-type feature like KeePassXC (something that mystifies coworkers who see that in action for t…
I'm doing similar thing with KeePass. While there are browser extensions to work with KeePass, I decided to not use those. I'm using Ctrl+B, Ctrl+V for user name and I'm using Ctrl+V which sends keystrokes into browser to fill password. Actually most of websites remember my login information for a long time, so this is not a problem at all. And I like to keep some sense of control over my private data.
You're losing out on certain types of phishing protections by doing this. You're also potentially opening yourself up to any apps/tools that are keeping an eye on your clipboard if you're copying and pasting. Auto-type might help with that, but I also wouldn't hold my breath for such a feature coming.
That is the one thing that worries me about iOS (okay: the BIGGEST concern, not the ONLY concern) now that's it has been shown that TikTok and LinkedIn (apps not on my phone) have been shown to be copying the contents of the clipboard. I had not thought of using a browser plugin to avoid clipboard scavengers on non-mobile OSes: I'll have to give that some thought now.
iOS have standard API for password managers. There's no reason not to use it.
KeePassXC and Bitwarden are the best password managers in existence right now: KeePassXC if you want to be disconnected from the cloud and Bitwarden if you want both the convenience of cloud-based password management AND high security.
How can anyone switch to bitwarden given how complex it is to switch back in the future? I love keepass because I am allowed to export my DBS to any other provider with ease. For bitwarden, there is not a good export system (that includes attachments,images...),meaning that I would be vendor locked.
Not an excuse for poor export capabilities but you can absolutely DIY with bitwarden-cli.
I’ve been using KeePassXC almost as long as it’s been available, and couldn’t be happier. Database stored on my NAS and synced to Dropbox for when I’m out, gives me access on all my devices without having to worry about whether x or y service will still be around in a year or 2.
Started using Keypass about a year ago, I really like it. Just wondering if Dropbox is considered a safe place to store the DB files? I did this for a while, but then I got paranoid and switched to something fully encrypted. For sharing between devices I found Firefox Send to be useful (before it went down, hope it comes back), also Keybase filesystem is one of my go-tos as well. Maybe I’m being overly cautious, but…
I have read that the KDBX4 password database is "very secure" but am curious if any hacking challenges have been conducted to see if anyone can break it? The challenge I have in mind put some kind of contact info in an entry and then post the KDBX file on a public site for anyone to download and try to hack. If you get it open, use the info to contact the contest organizers and once you explain how you overcame the s…
There have been audits of the official KeePass.info software which some argue still has open vulnerabilities.
Not sure if there have been audits of this popular fork or the format itself.
IIRC the format is relatively simple: an encrypted XML stream. So it may be OK.
I’ve been using KeePassXC almost as long as it’s been available, and couldn’t be happier. Database stored on my NAS and synced to Dropbox for when I’m out, gives me access on all my devices without having to worry about whether x or y service will still be around in a year or 2.
Started using Keypass about a year ago, I really like it. Just wondering if Dropbox is considered a safe place to store the DB files? I did this for a while, but then I got paranoid and switched to something fully encrypted. For sharing between devices I found Firefox Send to be useful (before it went down, hope it comes back), also Keybase filesystem is one of my go-tos as well. Maybe I’m being overly cautious, but…
Your database is encrypted by default. Additional encryption won't hurt, of course, but you can absolutely use Dropbox.