Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.6.1

keepassxc.org

Post reply on HN
Print view View original

61–70 of 119 posts

Re: KeePassXC 2.6.1

#61

Post by rcMgD2BwE72F »

nanna wrote: post #46
ObsoleteNerd wrote: post #4

I’ve been using KeePassXC almost as long as it’s been available, and couldn’t be happier. Database stored on my NAS and synced to Dropbox for when I’m out, gives me access on all my devices without having to worry about whether x or y service will still be around in a year or 2.

Syncthing is a nice alternative to Dropbox. If you use multiple computers at different locations, you could, say, use Syncthing to sync your KeepassXC database between your home computer and your phone, and between your phone and your work computer, without it ever touching a third party service.

It has worked for me perfectly for quite a long time. All my personal documents and photos are synced between an Android phone, my RPi 4 and my laptop. I haven't touched the settings for years. It just always works, 100% perfectly. I don't understand why it isn't more popular.

Re: KeePassXC 2.6.1

#62

Post by Latty »

AnIdiotOnTheNet wrote: post #52
selykg wrote: post #15

Earlier quoted context omitted.

You're losing out on certain types of phishing protections by doing this. You're also potentially opening yourself up to any apps/tools that are keeping an eye on your clipboard if you're copying and pasting. Auto-type might help with that, but I also wouldn't hold my breath for such a feature coming.

If you are infected with a clipboard logger chances are it is also a keyboard logger. Frankly, at that point you're unlikely to be saved by a browser extension anyway.

I'm not sure I follow. Browser extensions aren't simulating keyboard strokes, so they absolutely would save you in that case.

Re: KeePassXC 2.6.1

#63

Post by Latty »

vbezhenar wrote: post #24
mikece wrote: post #9

Earlier quoted context omitted.

A habit I carried over from using KeePassXC is that I don't use a browser extension. Call it paranoia but I don't want the browser process to have the ability to reach into my password manager. What I do is pin the Bitwarden tab open and just copy & paste where needed. For the desktop app it would be awesome if it had an auto-type feature like KeePassXC (something that mystifies coworkers who see that in action for t…

I'm doing similar thing with KeePass. While there are browser extensions to work with KeePass, I decided to not use those. I'm using Ctrl+B, Ctrl+V for user name and I'm using Ctrl+V which sends keystrokes into browser to fill password. Actually most of websites remember my login information for a long time, so this is not a problem at all. And I like to keep some sense of control over my private data.

As pointed out elsewhere in this thread, there is a danger here that you have to manually verify the origin of the page you are on, which makes you far more vulnerable to phishing attacks, which are common and can be very sophisticated (things like pages that look like normal content but change to a fake Google log in page when you minimise the page, so when you come back, it is there waiting).

Re: KeePassXC 2.6.1

#64

Post by snowwrestler »

kspacewalk2 wrote: post #33
mikece wrote: post #2

KeePassXC and Bitwarden are the best password managers in existence right now: KeePassXC if you want to be disconnected from the cloud and Bitwarden if you want both the convenience of cloud-based password management AND high security.

>best password managers in existence right now I am using 1Password with a standalone licence (sunk cost, so 'free' doesn't matter much. Also, C$70 is essentially free when it comes to securing my digital life). I sync a vault with a few co-workers via Dropbox and this is sufficient for us, no need for 1Password.com 'cloud' yet. We like the UI, and to our knowledge 1Password has the best track record for security, wi…

1Password seems to have a better reputation for security among commercial providers.

But KeePassXC is based on the KeePass file format, and to my knowledge that has a better security story than commercial platforms--though it is harder to use.

For example, a couple of years ago Tavis Ormandy at Google Project Zero went through password managers and had unkind things to say (and reported vulnerabilities) about LastPass, 1Password, and Dashlane. He said KeePass looks "sane" or something like that.

Re: KeePassXC 2.6.1

#65

Post by AnIdiotOnTheNet »

Latty wrote: post #62
AnIdiotOnTheNet wrote: post #52

Earlier quoted context omitted.

If you are infected with a clipboard logger chances are it is also a keyboard logger. Frankly, at that point you're unlikely to be saved by a browser extension anyway.

I'm not sure I follow. Browser extensions aren't simulating keyboard strokes, so they absolutely would save you in that case.

You assume that any malware that is in a position to log keyboard and clipboard events is somehow not in a position to do things like install its own trusted certificate, perform dll injection, or otherwise intercept the password anyway. Not to mention that with all the other things it has access to it might not need said password to fuck up your life.

Its a poor argument for choosing browser extensions over cut & paste because the circumstances where it has an advantage are incredibly specific.

Re: KeePassXC 2.6.1

#66

Post by oropolo »

ProNeo wrote: post #51

Any reason to switch over from KeePass to KeePassXC? I'm only using Windows so the cross platform argument doesn't hit me actually.

The KeePassXC developers are quite conscious about memory security and implement that in XC in a way that's not really possible with a .NET application like KeePass: https://keepassxc.org/blog/2019-02-21-memory-security/

Re: KeePassXC 2.6.1

#67

Post by jamesponddotco »

spanhandler wrote: post #57
chucky wrote: post #40

Earlier quoted context omitted.

Source code access, and being free of charge seems to be the main things you would get compared to 1Password. Also, great Linux support (from what I've heard 1Password only recently even added a Linux-compatible client). But to me it sounds like you have a solution you are very happy with, and you don't mind paying for that solution, so my recommendation would be to stick with it. Although, as a happy user of KeePass…

> (from what I've heard 1Password only recently even added a Linux-compatible client). Just plugins for Firefox and Chrome, AFAIK, actually. And a command line client that's just a wrapper for the website. No full-featured client available. KeePassXC can be a better option for interop with 1pass than 1pass is, on Linux, depending on what you need.

There is also a hybrid client[1][2] now, written in Rust, and Electron. Although the command-line client will always be my favourite, as I always have a terminal window open anyway, at least those who dislike the command-line or prefer a GUI client have another option now.

[1] https://discussions.agilebits.com/discussion/114964/1passwor...

[2] Read-only for now, as it is a development preview.

Re: KeePassXC 2.6.1

#68

Post by selykg »

AnIdiotOnTheNet wrote: post #65
Latty wrote: post #62

Earlier quoted context omitted.

I'm not sure I follow. Browser extensions aren't simulating keyboard strokes, so they absolutely would save you in that case.

You assume that any malware that is in a position to log keyboard and clipboard events is somehow not in a position to do things like install its own trusted certificate, perform dll injection, or otherwise intercept the password anyway. Not to mention that with all the other things it has access to it might not need said password to fuck up your life. Its a poor argument for choosing browser extensions over cut & pa…

Of course, but in the case that the app is not actually "attacking" you, and is instead just poorly written and/or poorly thought out you're reducing your risk.

A lot of time you can attribute compromises to ignorance rather than malice.

So an app that is stupidly logging the clipboard and doing dumb things with that data, rather than being a malicious app.

Not much can help you if an app on your machine is in a position of power.

Re: KeePassXC 2.6.1

#69

Post by george_perez »

spanhandler wrote: post #57
chucky wrote: post #40

Earlier quoted context omitted.

Source code access, and being free of charge seems to be the main things you would get compared to 1Password. Also, great Linux support (from what I've heard 1Password only recently even added a Linux-compatible client). But to me it sounds like you have a solution you are very happy with, and you don't mind paying for that solution, so my recommendation would be to stick with it. Although, as a happy user of KeePass…

> (from what I've heard 1Password only recently even added a Linux-compatible client). Just plugins for Firefox and Chrome, AFAIK, actually. And a command line client that's just a wrapper for the website. No full-featured client available. KeePassXC can be a better option for interop with 1pass than 1pass is, on Linux, depending on what you need.

No, they have a client now. https://discussions.agilebits.com/discussion/114964/1passwor...

HN discussion: https://news.ycombinator.com/item?id=24054112

Re: KeePassXC 2.6.1

#70

Post by nix23 »

40four wrote: post #20
ObsoleteNerd wrote: post #4

I’ve been using KeePassXC almost as long as it’s been available, and couldn’t be happier. Database stored on my NAS and synced to Dropbox for when I’m out, gives me access on all my devices without having to worry about whether x or y service will still be around in a year or 2.

Started using Keypass about a year ago, I really like it. Just wondering if Dropbox is considered a safe place to store the DB files? I did this for a while, but then I got paranoid and switched to something fully encrypted. For sharing between devices I found Firefox Send to be useful (before it went down, hope it comes back), also Keybase filesystem is one of my go-tos as well. Maybe I’m being overly cautious, but…

>Keybase

They are sold to ZOOM...since then i dont use it anymore

Post reply on HN