11 ms·
KeeWeb: Unofficial KeePass web and desktop client
- talles 11y agoI always get confused with KeePass, KeePass2 and KeePassX... I use KeePassX on OS X. Will I be able to use this one with my database file?
- tP5n 11y agotake a look at the data format of your database instead of the program you are using, it's much less confusing. keeWeb supports the newer .kdbx format that keepass2 introduced and keepassX can convert to from the older .kdb format. so... yes, it will work.
- papercrane 11y agoAccording to their FAQ[1], maybe. They test integration with KeePass, but it should work as long as you're using the .kdbx database format (KeePass v2.) [1] https://github.com/antelle/keeweb/wiki/FAQ https://github.com/antelle/keeweb/wiki/FAQ
- tui 11y agoI also using KeepassX on Ubuntu and Mac, but this app said unable to open my db on Mac.
- ngrilly 11y agoTry MacPass. It's great. http://mstarke.github.io/MacPass/ http://mstarke.github.io/MacPass/
- yoasif_ 11y agoThanks, giving this a shot!
- ivanhoe 11y agoThe latest version of KeePassX is using the same database format as KeePass2 and this app, so you should be ok. If you are using older (KeePass v1 compatible) format of the database just upgrade it in the lates version of KeePassX, it will convert all the data for you.
- zaphoyd 11y agoHow does it handle multiple users/computers trying to write to a database on dropbox?
- drdaeman 11y agoThis. Reading KeePass database is simple. The problem with KeePass is that its sync protocol is undocumented and reportedly arcane. And just syncing opaque blobs at whole will eventually lead to data losses.
- Hello71 11y agoIt doesn't. source: https://github.com/antelle/keeweb/issues/70 https://github.com/antelle/keeweb/issues/70
- dorfsmay 11y agoI don't know about this version, but keepassx creates a file in the same directory where the password kdb file is, and use it as a lock. But, keep in mind that dropbox can delay updates to the server (could be hours if you are disconnected) with no warning to the user, which means that two different users could update the same file independently and create a conflict. For this reason, it isn't suitable as an enterprise solution. Having said that I recommend dropbox as a poor man escrow, so that somebody you trust as easy access to all your passwords for banking, social network (keep your alt accounts somewhere else :-) ), servers' root, etc...
- zaphoyd 11y agoYep, aware of how KeepassX does this. Its better than some (i.e. there are locks at all) but dropbox doesn't always cooperate. Have been looking for a better solution, but most seem to not even do the lock file thing.
- wwarren 11y agoThis is awesome. People are obviously going to give you a hard time about security and your implementation of the important parts of the software, but that's the advantage of open source! Edit: I am a daily user of KeePassX and get really tired of the UI after a while so I will definitely be trying this out ASAP!
- ngrilly 11y agoWhich version of KeePassX are you using? The 2.0 seems better. And if you use a Mac, have you tried MacPass?
- florianletsch 11y agoMacPass is excellent. It finally helped me completely move to a password manager based life.
- softawre 11y agoHow is it better than KeyPassX? I (think I) want my manager to be simple..
- hollander 11y agoIt's native, much better user interface. Downside - for now: it's alpha, not even beta yet, so better keep a backup of your database.
- spurgu 11y agoExcept it can't synchronise (edit: yet) so it's useless for multiple users.
- CaptSpify 11y agoI found 2.0 to be worse, but that's just my subjective opinion. I don't have a mac, so maybe that's a difference?
- wwarren 11y ago
- theomega 11y agoWould it be possible to connect this to WebDav (i.e. Own cloud)?
- netoarmando 11y agoThey have plans for that in Q2 2016. (https://github.com/antelle/keeweb/wiki/TODO https://github.com/antelle/keeweb/wiki/TODO)
- floriangosse 11y agoThere is a build in Dropbox support. I think it should be possible to extend it by owncloud or other providers.
- greggarious 11y agoThis is great. My weekend project this weekend was to move to KeePassX, but it's not very usable. This UI is great!
- hollander 11y agoTry MacPass!
- greggarious 11y agoThanks a ton - extremely helpful reply!
- phjesusthatguy3 11y agoThat's pretty nice. I'm going to look into packaging it for myself for FirefoxOS. My only issue with it right now is aesthetic: the top item (search box on the main page, "< back to list" in entries, etc) scrolls off the top of the screen, leaving that much blank white space at the bottom of the screen. I'm on a ZTE Open C running the nightly version of FxOS from http://builds.firefoxos.mozfr.org/doc/en/devices/zte-open-c-eu http://builds.firefoxos.mozfr.org/doc/en/devices/zte-open-c-...
- C0d3r 11y agoOfftopic but, are you using FirefoxOS in your main phone? Is it good enough? I have one but never found it useful...
- phjesusthatguy3 11y agoYes, my only phone is FxOS. No, it's not good enough. I'm sure if I was on better hardware, it would be okay. My only requirements for it are a) decent web browser (it fails on this point) and b) Google 2 factor auth (I'm using GAuth[0]). I really don't care about playing games on my phone (I have a hacked PS Vita for that) and I have a laptop for everything else. [0]https://marketplace.firefox.com/app/gauth https://marketplace.firefox.com/app/gauth
- magicmu 11y agoLooks awesome! I've been using 1password, are there any big advantages that KeePass has over it?
- xbryanx 11y agoIt's free
- JupiterMoon 11y agoIt's not just free it is FLOSS.
- geostyx 11y agoI forgot to floss this morning :(
- jug5 11y agoOpen source
- cmrx64 11y agoI'm not sure about "big", it all depends on how much you trust 1password and what your threat model is. For me, the advantage of keepass is that I don't need to upload my credentials anywhere, or trust some closed source blob running in the browser, etc. It has a XML format that enables things like this client to be created. 1password has the advantage of excellent platform integration on iOS, and various browser extensions with auto-fill.
- oneeyedpigeon 11y ago> the advantage of keepass is that I don't need to upload my credentials anywhere But if you want to sync your credentials across devices, you still have to upload them somewhere, right? Doesn't this just support sync via Dropbox? If so, aren't you then just playing the trust game between two third-parties?
- deleted 11y ago[deleted]
- Sir_Cmpwn 11y agoCheck out pass for those wanting a solution in line with the Unix way: https://www.passwordstore.org/ https://www.passwordstore.org/
- datamoshr 11y agoI've previously looked into this and stopped half way through migrating my lastpass. I have a rather naive question: For the replication across devices this tool relies on git, but where are folks setting up the origin?
- Sir_Cmpwn 11y agoI host mine on gogs.sr.ht, a private git service I run for myself and friends. I used to host it on a private GitHub repository. There are other options like a private Bitbucket repository, or even just a public repo on GitHub - since the passwords are all encrypted, you don't really have to worry about that. I'll happily give an sr.ht account to anyone who wants one for this purpose, mention HN in your application comments: https://sr.ht https://sr.ht
- zipperhead 11y agoOne issue I have with pass is that it leaks meta-data about what you have stored. The contents are encrypted, yes, but the filename identifying the content is sitting right there in the open.
- deleted 11y ago
- dchest 11y agoDo not generate passwords with it, it uses insecure Math.random: https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd393f6a9cbba00b1c85720/lib/crypto/random.js#L19 https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3... https://github.com/antelle/keeweb/blob/master/app/scripts/util/password-generator.js#L29 https://github.com/antelle/keeweb/blob/master/app/scripts/ut... (in meme form: https://imgur.com/FcZNflQ https://imgur.com/FcZNflQ) Filed issue: https://github.com/antelle/kdbxweb/issues/5 https://github.com/antelle/kdbxweb/issues/5 (embarrassing/funny: it was me who wrote Salsa20 "user-space" generator used here (https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd393f6a9cbba00b1c85720/lib/crypto/salsa20.js#L3 https://github.com/antelle/kdbxweb/blob/906e927d3e3384db4dd3...), but it should be properly seeded from secure random number source to be secure. Added this note to the gist where the author found it: https://gist.github.com/dchest/4582374#file-salsa20-js-L1-L16 https://gist.github.com/dchest/4582374#file-salsa20-js-L1-L1...)
- judofyr 11y agoIs there a practical attack for this usage? The attacker would need to have a bunch of your passwords already? EDIT: Not that I'm justifying using Math.random, I just don't see why you so strongly recommend against using this tool.
- blakesterz 11y ago>> Is there a practical attack for this usage? This is the question I ask every single time I read about anything in security. It feels like there's just SO MANY THINGS wrong about every damn thing now the only way I can figure out what I have to really worry about or focus on is anything with a PRACTICAL attack that's easily automated and remotely exploitable.
- dchest 11y agoCryptographic attacks become better, some of them become practical. RC4 attacks were not considered practical until recently, and now everyone runs with their heads on fire replacing it. The best answer is to listen to what security people say. When they have a practical attack on something it is already too late.
- pickle27 11y agoI've been waiting / hoping someone would build this! thanks!
- openaccount 11y agoThe notes field should be a multiline text field. This is mandatory since some data needs more explanation than just a password.
- qertoip 11y agoExcellent work! Clean, beautiful and works out of the box. Is there any way to have a system-wide shortcut to auto-enter passwords? In KeePassX it's called "Global Auto Type Shortcut". I just can't live without this ;)
- slavik81 11y agoThe title should probably be "KeyWeb - a KeePass Web and desktop client" to be clear that this is not the official KeePass client. I was briefly concerned because I generated many passwords with KeePass, but this post is about a different piece of software.
- dang 11y agoWe added "unofficial" to the title.
- relaxitup 11y agoDoes there exist an enterprise grade server/webui solution based on a keepass db? We are looking for an enterprise password manager solution that does not need all the ldap/ad integration bells/whistles (although we may explore ldap integration with the tool in the future). So I was thinking why not just use keepass. And by enterprise grade I guess I really mean it needs to be a multi user solution, but everyone would be working from the same pw db..
- paulryanrogers 11y agoPleasantSolutions.com may help. (Full disclosure: I sell an unrelated KeePass plug-in.)
- relaxitup 11y agoThis looks very interesting thanks!
- mjs7231 11y agoThis looks awesome. My only gripes with KeePass is the confusion between KeePass,2,X etc; get it together guys. Also there is a serious lack of good browser extensions. There only seems to be one offering and its the clunkiest thing I have ever used. -- That said, as soon as the second problem is addressed, I'll be switching as soon as possible. I'd love to move off my proprietary solution to an open one.
- Sephr 11y agoThe reference implementation's domain is vulnerable to MITM attacks between KeeWeb and CloudFlare until they set their CloudFlare crypto settings to "strict" and get some real certificates of their own (e.g. Let's Encrypt). I submitted an issue here: https://github.com/antelle/keeweb/issues/111 https://github.com/antelle/keeweb/issues/111 Of course exploiting this would be very difficult, but it is possible to MITM the connection between the CloudFlare proxy and GitHub pages as long as keeweb.info continues to not use DNSSEC.
- Sephr 11y agoUpdate: The author has reasonably mitigated this vulnerability. This isn't much of an issue now.
- jareds 11y agoJust built this, looks good so far. Being a totally blind back-end developer I've wanted to look at web accessibility, while the app is accessible I think it could be made better so hopefully I can use this as a way to learn.
- deleted 11y ago[deleted]