Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass: OpenSource Password Manager

keepass.info

Post reply on HN
Print view View original

61–70 of 138 posts

Re: KeePass: OpenSource Password Manager

#61

Post by stormbrew »

gibybo wrote: post #60
stormbrew wrote: post #57

Earlier quoted context omitted.

Oh nice, I've been thinking about something like this a lot lately. I don't really like the idea of truncating the generated password, though. I'd rather it use a proper KDF and fill the password field to its limit.

I think the reason they did it is because a lot of sites have maximum password lengths that would prevent the full output. Those are exactly the type of sites that you want to be using something like this on.

Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter. It will obviously be truncated a lot of the time, but I'd rather it be truncated at thelongestpossible point.

From looking around it seems like the reason is that they wanted the visual representation of typing the password to reflect the number of characters you actually typed as you type them. I'm not sure if this comes out true, though, as I can't actually get it to work in chrome.

Re: KeePass: OpenSource Password Manager

#62

Post by LocalPCGuy »

jlgaddis wrote: post #48
AceJohnny2 wrote: post #34

I've been having it on my various systems (Windows, Linux, Android) in the sidelines for a couple months, and after initial fiddling, still haven't actually started using it. This is mostly because I don't want to have to deal with copy-pasting my password between the KeePass app and the browser (where most of my passwords are needed). Luckily, there are autofill plugins that exist for Chrome [1], Firefox [2], and An…

For personal use, I've been using LastPass for a few years but have been slowly migrating away from it in recent months. I'm switching to KeePassX which I already use for $work-related data. (I have intentionally avoided the Mono-based applications.) KeePassX has similar "auto-fill" functionality as well. It's not as perfect or as seamless as LastPass but it is definitely usable (after a bit of one-time per-site twea…

As others have said, why migrating away from LastPass? They definitely seem to be doing things properly in terms of security and I've been very happy with the security, as well as the ease of use when I set it up on a new machine.

Re: KeePass: OpenSource Password Manager

#63

Post by Fasebook »

goodside wrote: post #58
falcolas wrote: post #56

Earlier quoted context omitted.

And hoping it includes all the java it needs, and doesn't go out and pick up some 3rd party library? You would have to audit it to ensure it never includes everything else, or posts anything externally with every release. Not my cup of tea, personally.

> And hoping it includes all the java it needs, and doesn't go out and pick up some 3rd party library? What Java? It's a self-contained, monolithic HTML file with JS and CSS inline. What dependency are you imagining you're not going to have? > You would have to audit it to ensure it never includes everything else, or posts anything externally with every release. Exactly as you would with KeePass, or any other conceiv…

Don't forget to audit your browser (the thing without a version number anymore and with various metatemplates and it dynamically downloads on every load) and it's implementation of ECMAScript. But everyone already knew that.

Really, auditing this is impossible.

Re: KeePass: OpenSource Password Manager

#64

Post by gibybo »

stormbrew wrote: post #61
gibybo wrote: post #60

Earlier quoted context omitted.

I think the reason they did it is because a lot of sites have maximum password lengths that would prevent the full output. Those are exactly the type of sites that you want to be using something like this on.

Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter. It will obviously be truncated a lot of the time, but I'd rather it be truncated at thelongestpossible point. From looking around it seems like the reason is that they wanted the visual representation of typing the password to reflect the number of characters you actually typed as you type them. I'm not sure if thi…

The chrome extensions requires putting '@@' at the start of the password field. This turns it yellow to indicate it is now active for that field.

>Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter.

Yes, but in my experience sites rarely implement this. If they do, it's probably inconsistent (i.e. different limits on the login field, create account, and reset password fields).

Re: KeePass: OpenSource Password Manager

#66

Post by Fogest »

jlgaddis wrote: post #51
Fogest wrote: post #23

Any way to transfer LastPass passwords? I've got a huge deal of entries in Lastpass

That was my biggest issue with switching as I have hundreds of entries in LastPass. I spent a few hours moving over my most important/frequently used entries. For the "leftovers", I simply move 'em from LastPass to KeePassX as I need/use them.

I just figured out I could get the portable LastPass -> Export CSV, and then import that in KeePass

Re: KeePass: OpenSource Password Manager

#67

Post by kyrra »

Mitt wrote: post #19
joebeetee wrote: post #15

How does it compare to 1Password? Lmgtfy, I know, just wanted HN's thoughts.

It is GPL and you have the control over your keyfile(s). A browser plugin for the commercial services could any time sneak evil bits in, so you might feel less safe with them (they could upload your masterkey or your decrypted keyfile, when asked by the NSA).

Evil bits could just as easily sneak into Keepass if the author wanted to. It would require someone else constantly auditing all commits along with verifying binary builds posted on the website match the current source's compiled output.

Edit: my above comment is just to prove a point. We put trust in a lot of the software we run. Software being open source does provide some safety, but very very few people will go through the effort to make that verification.

Re: KeePass: OpenSource Password Manager

#68

Post by Fogest »

If I save the database to dropbox so that I have it on multiple PC's at once, how can I ensure I do not overwrite a database that has new entries?

For example say on PC-A I make a change and save it. On PC-B I have the old database still opened and loaded in KeePass. What happens if I then save in PC-B without opening the database up? That means I just lost the one password?

Re: KeePass: OpenSource Password Manager

#69

Post by stormbrew »

gibybo wrote: post #64
stormbrew wrote: post #61

Earlier quoted context omitted.

Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter. It will obviously be truncated a lot of the time, but I'd rather it be truncated at thelongestpossible point. From looking around it seems like the reason is that they wanted the visual representation of typing the password to reflect the number of characters you actually typed as you type them. I'm not sure if thi…

The chrome extensions requires putting '@@' at the start of the password field. This turns it yellow to indicate it is now active for that field. >Sure, but as long as the site actually sets the password length limit on the field it shouldn't matter. Yes, but in my experience sites rarely implement this. If they do, it's probably inconsistent (i.e. different limits on the login field, create account, and reset passwo…

Yep, tried that. Just doesn't do anything at all as far as I can tell. Maybe it has issues with linux chromium? I dunno.

Re password lengths, my experience is that they usually truncate on the server side at that point, rendering it pretty moot. But yes, I do see this problem. I'm just not sure you're not going to run into it either way if you're practicing good password hygiene. I'd still prefer it make an attempt at adding as much difficulty to the password as possible, though.

Re: KeePass: OpenSource Password Manager

#70

Post by hartror »

Fogest wrote: post #68

If I save the database to dropbox so that I have it on multiple PC's at once, how can I ensure I do not overwrite a database that has new entries? For example say on PC-A I make a change and save it. On PC-B I have the old database still opened and loaded in KeePass. What happens if I then save in PC-B without opening the database up? That means I just lost the one password?

We use a source code repo to handle this. Not perfect but better than losing a password.
Post reply on HN