51–60 of 138 posts
Any way to transfer LastPass passwords? I've got a huge deal of entries in Lastpass
I recommend OneShallPass ( http://oneshallpass.com ) over KeePass. It's open source and auditable like KeePass, but: 1) It doesn't have to be compiled or installed, since it's just a monolithic HTML page with all JS/CSS inline. 2) It has a free, optional hosted service that stores encrypted passwords with pure client-side decryption, so you can get your passwords from any web-enabled device without having to trust th…
> 2) It has a free, optional hosted service that stores encrypted passwords with pure client-side decryption, so you can get your passwords from any web-enabled device without having to trust the host. This is an unbelievably audacious security shell game; I can't really believe this nonsense idea has somehow managed to gain traction. The server is ephemerally delivering the code that supposedly encrypts your content…
By saving the HTML file and opening your local copy. You can audit the code and verify yourself that nothing will go over the wire unencrypted to their servers, so you get the benefit of them hosting the encrypted passes without having to trust them with your data. If you want it available anywhere, you don't want to save the file locally, and you don't trust the host, just host it yourself or grab it from Github.
I've been a long time user of Password Safe. Any compelling reason to switch to KeePass?
I've been having it on my various systems (Windows, Linux, Android) in the sidelines for a couple months, and after initial fiddling, still haven't actually started using it. This is mostly because I don't want to have to deal with copy-pasting my password between the KeePass app and the browser (where most of my passwords are needed). Luckily, there are autofill plugins that exist for Chrome [1], Firefox [2], and An…
For personal use, I've been using LastPass for a few years but have been slowly migrating away from it in recent months. I'm switching to KeePassX which I already use for $work-related data. (I have intentionally avoided the Mono-based applications.) KeePassX has similar "auto-fill" functionality as well. It's not as perfect or as seamless as LastPass but it is definitely usable (after a bit of one-time per-site twea…
LastPass user here, wondering why?
Earlier quoted context omitted.
> 2) It has a free, optional hosted service that stores encrypted passwords with pure client-side decryption, so you can get your passwords from any web-enabled device without having to trust the host. This is an unbelievably audacious security shell game; I can't really believe this nonsense idea has somehow managed to gain traction. The server is ephemerally delivering the code that supposedly encrypts your content…
> How do you not have to trust the host? By saving the HTML file and opening your local copy. You can audit the code and verify yourself that nothing will go over the wire unencrypted to their servers, so you get the benefit of them hosting the encrypted passes without having to trust them with your data. If you want it available anywhere, you don't want to save the file locally, and you don't trust the host, just ho…
You would have to audit it to ensure it never includes everything else, or posts anything externally with every release.
Not my cup of tea, personally.
For those looking for something ultra lightweight, I highly recommend pwdhash ( http://pwdhash.com ). It's not a password manager, it's just an open source hashing algorithm that protects you from sites storing your password poorly. Instead of depending on them to store your password in a one-way hash, it does it on your end before sending the password to the site. The algorithm is very roughly base64encode(hash(pass…
Earlier quoted context omitted.
> How do you not have to trust the host? By saving the HTML file and opening your local copy. You can audit the code and verify yourself that nothing will go over the wire unencrypted to their servers, so you get the benefit of them hosting the encrypted passes without having to trust them with your data. If you want it available anywhere, you don't want to save the file locally, and you don't trust the host, just ho…
And hoping it includes all the java it needs, and doesn't go out and pick up some 3rd party library? You would have to audit it to ensure it never includes everything else, or posts anything externally with every release. Not my cup of tea, personally.
What Java? It's a self-contained, monolithic HTML file with JS and CSS inline. What dependency are you imagining you're not going to have?
> You would have to audit it to ensure it never includes everything else, or posts anything externally with every release.
Exactly as you would with KeePass, or any other conceivable solution. If you don't want to audit future releases, save the last one you audited and use that.
Earlier quoted context omitted.
For personal use, I've been using LastPass for a few years but have been slowly migrating away from it in recent months. I'm switching to KeePassX which I already use for $work-related data. (I have intentionally avoided the Mono-based applications.) KeePassX has similar "auto-fill" functionality as well. It's not as perfect or as seamless as LastPass but it is definitely usable (after a bit of one-time per-site twea…
> I've been using LastPass for a few years but have been slowly migrating away from it in recent months. LastPass user here, wondering why?
For those looking for something ultra lightweight, I highly recommend pwdhash ( http://pwdhash.com ). It's not a password manager, it's just an open source hashing algorithm that protects you from sites storing your password poorly. Instead of depending on them to store your password in a one-way hash, it does it on your end before sending the password to the site. The algorithm is very roughly base64encode(hash(pass…
Oh nice, I've been thinking about something like this a lot lately. I don't really like the idea of truncating the generated password, though. I'd rather it use a proper KDF and fill the password field to its limit.