Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass: OpenSource Password Manager

keepass.info

Post reply on HN
Print view View original

71–80 of 138 posts

Re: KeePass: OpenSource Password Manager

#71

Post by goodside »

Fasebook wrote: post #63
goodside wrote: post #58

Earlier quoted context omitted.

> And hoping it includes all the java it needs, and doesn't go out and pick up some 3rd party library? What Java? It's a self-contained, monolithic HTML file with JS and CSS inline. What dependency are you imagining you're not going to have? > You would have to audit it to ensure it never includes everything else, or posts anything externally with every release. Exactly as you would with KeePass, or any other conceiv…

Don't forget to audit your browser (the thing without a version number anymore and with various metatemplates and it dynamically downloads on every load) and it's implementation of ECMAScript. But everyone already knew that. Really, auditing this is impossible.

By that logic, you can't know KeePass is safe without auditing Mono, your compiler, your checksum tool, the editor you used for the audit, the logic gates of your CPU, etc. Auditing anything is impossible.

If you can't get a copy of Firefox that you trust hasn't been altered as part of a conspiracy to make you believe OneShallPass is a legit password manager, you've got bigger problems.

Re: KeePass: OpenSource Password Manager

#72

Post by brownbat »

I use a password locker.

It makes me wish there was an open standard for sites to negotiate a new entry with a password manager, something automatic in the background for new registrations.

Site could send password restrictions, like allowed and required character types, minimum length, even maximum length, though that last one would be frowned upon. The locker would reply with a preferred username and random password and add same to the database upon acceptance.

Re: KeePass: OpenSource Password Manager

#73

Post by Fogest »

hartror wrote: post #70
Fogest wrote: post #68

If I save the database to dropbox so that I have it on multiple PC's at once, how can I ensure I do not overwrite a database that has new entries? For example say on PC-A I make a change and save it. On PC-B I have the old database still opened and loaded in KeePass. What happens if I then save in PC-B without opening the database up? That means I just lost the one password?

We use a source code repo to handle this. Not perfect but better than losing a password.

What if I am using a mobile device though?

Re: KeePass: OpenSource Password Manager

#74

Post by Brajeshwar »

Being on OS X, I have moved to 1Password. I'm, to this day, a dedicated proponent of Keepass. Anyone, asking me to suggest a Password Manager - my first answer is Keepass (Windows or Linux). Even for OS X, if one cannot afford 1Password yet or do not want to buy it just yet, Keepass is the one.

* Spend some time learning the Keyboard shortcuts and you're all set.

* Keep the Keepass File on Dropbox, so it's sync across your machines and is backed up.

* Sharing common credentials with a team - server login details, team site details etc - have a common Keepass File on Dropbox and share it with your team. Suggestion is to open it as "read-only" unless you're adding new entries.

* You can also have an additional layer of security by using an additional (optional) Key Locker File (besides the main password) to lock Keepass. You can have that on a thumb-drive or some place you know.

* One thing I really wish 1Password has what Keepass has is the auto-generation a password when you enter a new entry. One can set parameters of what password is generated. I have click to get that in 1Password.

P.S. If I remember correctly, Keepass even has a portable version.

Re: KeePass: OpenSource Password Manager

#76

Post by magic_haze »

AceJohnny2 wrote: post #34

I've been having it on my various systems (Windows, Linux, Android) in the sidelines for a couple months, and after initial fiddling, still haven't actually started using it. This is mostly because I don't want to have to deal with copy-pasting my password between the KeePass app and the browser (where most of my passwords are needed). Luckily, there are autofill plugins that exist for Chrome [1], Firefox [2], and An…

Keepass proper has a global Ctrl+Alt+A shortcut that automatically types in your username and password into the form: I've found it works fine on the majority of sites (almost everyone uses username-tab-password-enter, but for the few that don't, you can specify a custom auto type format in keepass. It even has an option to obfuscate the typing to trick keyloggers).

For android, I recommend Keypass2Android: it comes with a custom keyboard you can enable temporarily, which inputs your password without going through the android clipboard. I use it with the dropbox app as well, I'm not sure why it's not working for you.

Re: KeePass: OpenSource Password Manager

#77

Post by uptown »

Fogest wrote: post #66
jlgaddis wrote: post #51

Earlier quoted context omitted.

That was my biggest issue with switching as I have hundreds of entries in LastPass. I spent a few hours moving over my most important/frequently used entries. For the "leftovers", I simply move 'em from LastPass to KeePassX as I need/use them.

I just figured out I could get the portable LastPass -> Export CSV, and then import that in KeePass

Just make sure you don't have some sort of system-wide backup in-place that's going to backup the CSV file, in clear-text, on your disk during the migration.

Re: KeePass: OpenSource Password Manager

#78

Post by hughc »

Fogest wrote: post #68

If I save the database to dropbox so that I have it on multiple PC's at once, how can I ensure I do not overwrite a database that has new entries? For example say on PC-A I make a change and save it. On PC-B I have the old database still opened and loaded in KeePass. What happens if I then save in PC-B without opening the database up? That means I just lost the one password?

I've had this experience with 2.x and as I recall, on machine B where the file was already open with unsaved changes, I was prompted to merge changes after Dropbox updated the file on disk. Without recalling the details, I was pretty impressed.

Re: KeePass: OpenSource Password Manager

#79

Post by lispsil »

esMazer wrote: post #59
Goopplesoft wrote: post #55

Earlier quoted context omitted.

> I've been using LastPass for a few years but have been slowly migrating away from it in recent months. LastPass user here, wondering why?

same here, why?

This is probably a good reason ppl stopped using it http://www.tobtu.com/lastpass.php

Plus I wouldn't trust any browser plugin with passwords

Re: KeePass: OpenSource Password Manager

#80

Post by hughc »

Mitt wrote: post #22

I put a tiny Truecrypt container on my file hoster (HiDrive, Skydrive, Dropbox, etc.) in which I store the KeePass keystore. The keystore itself can't get decrypted, but in case AES has weaknesses one first needs to crack the triple encryption of AES+Serpent+Twofish of the Truecrypt container.

You've added another dependency into the mix here.

I've been comfortable storing my database in Dropbox, with a decent length master password (15char+) on the assumption that it uses a high quality hash that would make bruteforcing the encryption impractical, without having to add another layer of encryption above it. Curious if others feel this is a reasonable assumption?

Post reply on HN