Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.2.0 released with YubiKey and TOTP support

keepassxc.org

Post reply on HN
Print view View original

41–50 of 132 posts

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#43

Post by problems »

Still no KDBX 4 support though?

Please consider making it a priority - it looks like someone tried to pull request it but that failed? The older format uses a custom AES-based KDF - and while I don't personally see any major issues with it, I'm much more comfortable with the modern, heavily reviewed Argon2 design used in the KDBX4.

https://github.com/keepassxreboot/keepassxc/issues/148

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#44

Post by problems »

ktta wrote: post #42

Notable features: 1. Unlock using Yubikey 2. TOTP 2FA 3. Diceware password generator 4. ASLR for in-memory security (didn't expect this!) 5. Portable and Single instance mode (I'll have to check this one in detail) Thanks for your work team!

For anyone wondering - the TOTP 2FA is not on the password wallet itself, but that the wallet is able to store the TOTP key, authenticating TOTP involves knowing the key, by which point there's really no value in using it to authenticate the wallet, it'd be a UI-only protection.

However I think storing TOTP keys in your wallet is a bad idea for security - now if someone hacks your machine they get both your password and your TOTP key at the same time. The main advantage of TOTP is that it puts your second form of auth on a separate device, preventing a single point of compromise.

not much malware will exploit this as not many people will use it, but a targeted attack might greatly benefit from something like this.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#45

Post by balajics »

TokenDiversity wrote: post #39

Features I like: 1) Download website favicon (no clue how though, tried entering website but didn't see an option to download favicon) 2) Command line interface, no clue again how to use.

For 1) Download favicon option is there inside "icon" menu of a keepass entry. https://keepassxc.org/images/screenshots/macos/screen_003.pn...

I wish there was a way to download and associate favicon of all entries in one-click.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#46

Post by chrisper »

grawlinson wrote: post #9
sillysaurus3 wrote: post #6

So there's KeePass, KeePassX, and now KeePassXC? (And two different variants of KeePass that have nothing to do with each other.) Not that there's anything wrong with that. I'm just curious if KeePassXC is yet another fork, or if it's from the same people who did KeePassX. KeePassX has an excellent security reputation, so it'd suck if an unrelated fork ruined that.

There doesn't seem to be active development on KeePass/KeePassX, hence the KeePassXC fork. The C in the fork title apparently stands for 'community'. It has a lot of support behind it.

I believe the idea is to merge XC back to X down the road. Not sure if that goal changed.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#47

Post by Semaphor »

scott_karana wrote: post #32
underlines wrote: post #25

Earlier quoted context omitted.

I just wait for Android O Autofill Framework to arrive. Then mobile password managers will finally be useful.

Really?... The syncing and conflict resolution (or lack thereof) is the true problem for me.

Keepass2Android works great for me syncing over OwnCloud (they have several cloud sync options)

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#48

Post by finchisko »

Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too.

My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently working on replacing jquery popup implentation for hyperapp, which appeared here on HN yesterday.

If interested I can send instruction how you can build extentions. I would like to see this as official part of KeePassXC and willing to donate for free. What you guys think?

You can try options UI on https://mauron85.github.io/keepassxc-browser/preview/

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#49

Post by angelsl »

problems wrote: post #43

Still no KDBX 4 support though? Please consider making it a priority - it looks like someone tried to pull request it but that failed? The older format uses a custom AES-based KDF - and while I don't personally see any major issues with it, I'm much more comfortable with the modern, heavily reviewed Argon2 design used in the KDBX4. https://github.com/keepassxreboot/keepassxc/issues/148

That would be me.

I wrote the patch against the original KeePassX which seems to be no longer maintained (?). One of the KeePassXC guys asked me to rebase it over so I did. Then we (they) spent a week or two debating on how to support libargon2 and the newer libgcrypt required for ChaCha20, coming to no resolution, and I just lost any motivation to push for them to merge my patch.

They also disagreed with the way I implemented KDBX 4 (by adding conditionals to the KDBX reader/writer instead of just creating a whole new class — I did this because KeePass did it this way). I agree that it should be separated, but at that point I already gave up on getting them to accept my patch.

The PR is [here](https://github.com/keepassxreboot/keepassxc/pull/399), you can read it, I know I sound rather impatient here. The other PR on updating their Docker to get newer libraries (libargon2 and libgcrypt) is [here](https://github.com/keepassxreboot/keepassxc/pull/419).

I honestly thought someone else would take it up after I gave up to get it in by 2.2 (it's not even a very big patch), but.. I guess not.

Someone with more experience/patience/persistence, please, you can take the patch and rebase it and clean it up to what they want. You'll also need to wait for them to figure out how they want to use the libraries required with their packaging system.

Post reply on HN