18 ms·

KeepassXC – A cross-platform community fork of KeepassX

385 points by karlgrz 10y ago

snowwrestler 10y ago
From the text it looks like one of the selling points is integration with apps like browsers so you don't have to copy/paste passwords, as with KeePassX. Personally, to me that sort of integration has always seemed like a bad idea. I'm glad that my password database can't talk to my browser programmatically. One less thing to go wrong.
- dannysu 10y ago
  You don't have to use it. Also, a recently landed change allows you to exclude that feature entirely from the compiled binary if you want to build it yourself. Personally the best feature I'm using KeePassXC for is the auto-reload feature. I sync my kdbx file with Tresorit across couple computers, and the auto-reload feature ensures that I'm always modifying the latest version. This is something lacking in the original KeePassX.
- shmerl 10y ago
  One thing that stands out is usage of Qt 5. KepassX (at least the released version) is still using Qt 4.
  - smonff 10y ago
    It don't change drastically the features of the application.
    - favadi 10y ago
      Maybe with Qt5 it will scale correctly in HiDPI display?
- dorkygator 10y ago
  Yea, lastpass got burned by it with their chrome extension. After that, I switched from a web password manager to desktop password manager. Less attack surface area.
- mcpherrinm 10y ago
  Browser integration is one of the major security gains of using a password manager. It takes passwords and makes them "unphishable", because the manager knows what domain you're on. Of course it's also the largest attack surface. Personally, I think that tradeoff is worth it - assuming competent development.
  - dotancohen 10y ago
    > assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.
    - farjar 10y ago
      If assuming competent development is bad, as you claim, why would it be a better idea to use a closed source password manager like LastPass instead of an open source fork of KeepassX? If this program can accomplish everything that LastPass can accomplish, while also being open source, surely that's more trust worthy then a closed source implementation that you could not audit.
      - dotancohen 10y ago
        I'm not interested in the closed- or open- source aspects of the issue. I'm interested in allowing other browser extensions to access my passwords. The issue is whether or not passwords should be stored in a browser extension, not about access to the source code.
  - dotancohen 10y ago
    > assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.
  - majkinetor 10y ago
    It also protects from keylogers.
- est 10y ago
  So you don't need a password manager. Just save to a encrypted txt file and grep them.
  - nindalf 10y ago
    This isn't a great idea for a few reasons, but if you're looking for something like this, its possible to do it with a few lines of bash - Shitty Password Manager (https://github.com/nindalf/shitty-password-manager https://github.com/nindalf/shitty-password-manager)
  - ynezz 10y ago
    I won't do this daily on my Android phone.
  - snowwrestler 10y ago
    You can't grep for plaintext in an encrypted file. That's kind of the point of encryption.
    - loup-vaillant 10y ago
      $ decrypt psswd.txt | grep "mywebservice.com" Though now the password is displayed on the terminal... Not great, but better than exposing the whole database.
  - kristjan 10y ago
    You may also dig https://www.passwordstore.org/ https://www.passwordstore.org/
- jakeogh 10y ago
  It is manipulating the clipboard and inserting keystrokes (to switch between text fields in the login box). Unfortunately any running X app can do that. I would like more isolation too. QubesOS is the only thing I know of that does it.
  - noja 10y ago
    > any running X app can do that. Not on Wayland.
    - jakeogh 10y ago
      Cool. Found: http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and-how-to-handle/ http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and... https://lwn.net/Articles/589147/ https://lwn.net/Articles/589147/
- vanous 10y ago
  I love browser integration but am not willing to go to lastpass, therefore have to stay with the ugly, but well functioning .NET keepass2 client on desktop and with the nice keepass2android. > From the text it looks like one of the selling points is integration with apps like browsers so you don't have to copy/paste passwords, as with KeePassX. Can you provide source please? thank you. This [1] says the opposite: (quoting from the github issue): "I removed the milestone for now since we are not sure if we actually want our users to expose their passwords over a network protocol with questionable security record. The security of both KeePassHTTP and KeePassRPC is doubtable and in their current state we would prefer not to have them as part of the main KeePassXC product. This doesn't mean KeePassXC will never support it, it only means that at the moment we don't have immediate plans and an implementation needs further discussion." [1] https://github.com/keepassxreboot/keepassxc/issues/88#issuecomment-272626610 https://github.com/keepassxreboot/keepassxc/issues/88#issuec...
  - Nullabillity 10y ago
    Apparently it does support KeePassHTTP, if you recompile it with a special flag: https://keepassxreboot.github.io/project https://keepassxreboot.github.io/project
    - vanous 10y ago
      Yes, i just found it, thanks! Unfortunately, the on Firefox side, i can only use PassIFox extension, which has been too barebone to fit my needs. KeeFox has been excellent - especially if you have multiple accounts associated with single domain or even subdomains. What i use a lot is to open up a website with particular credentials (search in KeeFox by Ctrl-1) or to generate passwords (Ctrl-4) (good if you are the one making logins for other people).
  - ComodoHacker 10y ago
    >the ugly, but well functioning .NET keepass2 What's ugly about it, besides (I guess) .NET part?
    - 10y ago
- louib 10y ago
  AFAIK KeePassHttp, which integrates which PassIFox for Mozilla Firefox and chromeIPass for Google Chrome, is not part of KeePassXC by default.
dublinben 10y ago
If you were curious like I was, about why this fork was necessary, I found this on their About page: KeePassXC is a community fork of KeePassX which aims to incorporate stalled pull requests, features, and bug fixes that have never made it into the main KeePassX repository.
- sleavey 10y ago
  Do you know why they have been stalled? Perhaps there's a good reason, like code auditing? Just a shot in the dark - I have no idea.
  - roddux 10y ago
    Judging from TFA it's due to KeePassX having one maintainer, so the pull requests all bottleneck with him. Also mentioned is that one desirable outcome of this is that KeePassXC developers are given co-maintainer status of KeePassX and that they re-merge down the line.
    - shincert 10y ago
      That's cool. But if that's all this project is, couldn't they have just talked to the one maintainer and offer to help him and be on the team?
      - roddux 10y ago
        I would assume that avenue has been tried -- so this project is to pressurise him into opening up to the idea. No idea though.
      - zymhan 10y ago
        I wonder how often those conversations take place before someone(s) fork a project because it's "abandoned". But I love KeepassX and I'll certainly try using the fork.
      - thecardcheat 10y ago
        https://github.com/keepassxreboot/keepassxc/issues/43 https://github.com/keepassxreboot/keepassxc/issues/43 states the maintainer hasn't been commenting on PRs. I looked on the keepassx GitHub and some issues with no response are over 2 years old.
amluto 10y ago
I haven't tried it yet, but maybe this will address some of my pet peeves. My primary peeve is that, in keepassx, there is no fantastic way to handle password changes. I can generate a new password, but the only way to get it into a webpage without overriding the old password in the database is to show it on the screen and then copy the visible text. (My second peeve is that the "type the password" feature types the username and password, making it useless for the more annoying disabled-paste password prompts.)
- dublinben 10y ago
  Every entry should have a complete history of all passwords. I'm not sure why you'd be worried about the new password overwriting the old one. It's not gone forever. You can also customize the auto-type on a per site basis. Only the default types U + P. It can be anything you want it to be.
  - acidburnNSA 10y ago
    Yes. For example, you use {PASSWORD}{ENTER} as the custom auto-type command for a simple password dialog.
  - crypt1d 10y ago
    hmm I don't really see this feature in KeepassX, the history tab only shows changes to the entry name not the passwords. Am I missing something?
    - temprature 10y ago
      Select the old entry and click the "Show" button at the bottom, it takes you to the entry tab but with the old data in place so you can copy the old password.
- Rovanion 10y ago
  You can also precc Ctrl-c to copy the password of any entry. And I believe type the password can be configured since my keepassx doesn't do what you describe, it only types out the password.
shmerl 10y ago
The FAQ should explain the reason for the fork. I couldn't find anything about that, and that was the first question I had.
- rcthompson 10y ago
  The explanation is right here: https://keepassxreboot.github.io/project https://keepassxreboot.github.io/project But I agree, they should definitely link to it from the FAQ, since a lot of people are going to look there first.
  - shmerl 10y ago
    Thanks for the pointer!
mmel 10y ago
I tried to stick with KeePass.x for the longest time, but keeping the keepass databases in sync across multiple platforms/devices, while possible, was very much a pain and quite a clunky/messy process which always required me to remember to do something after updating the database anywhere. I eventually gave up and migrated to Lastpass which "Just Works™" on all my devices.
- dbg31415 10y ago
  I also like how LastPass can be administered by company / team admins, has 2FA, allows you to share passwords (or groups of passwords) with people (or teams of people), has some built in tools to help automate password updates, and can give you a quick at a glance audit of which passwords are old / insecure / are used more than once / are used for services that have been reported hacked and should be changed. But... HackerNews hates LastPass for some reason... still haven't quite figured out why. (= It's a great service.
  - r00fus 10y ago
    Perhaps because the concept of a cloud keychain is just too tempting for exploits? If someone gets my keychain they own me completely and can quite possibly ruin my life.
    - sthrs 10y ago
      You don't have to keep all of your credentials in LastPass. For example, I don't store any email credentials or important accounts such as Google or Microsoft. Everything else (like HN) is negligible if LastPass gets owned.
      - kakarot 10y ago
        So where is the benefit over keeping all of my passwords in a non-cloud storage solution with KeepassX2?
    - pixelcloud 10y ago
hailsaytan 10y ago
What happened to the Windows binaries?
zyxzkz 10y ago
Why not change the name entirely, then? KeepassX is already a terrible one. Makes me think of DOS software from 1998.
- alanbernstein 10y ago
  KeepassX is a clone/port of Keepass, if you weren't aware. Keepass is a decent name IMO.
  - hughes 10y ago
    How about QuiPasse?
    - nerflad 10y ago
      Que pasa?
      - djazzy 10y ago
        Que se passe-t-il ?
- cryptos 10y ago
  I don't like the name, too. KeepassX is terrible and KeepassXC odd even worse. Maybe we should start a contest to find a better name.
- smonff 10y ago
  It will be renamed PoneyPass when it will be ported to Electron.
- Grue3 10y ago
  But DOS executable name can be maximum 8 characters, KeepassXC is too long.
  - abrowne 10y ago
    KEEPSSXC.EXE
joelbondurant 10y ago
Cross-platform and no Android, interesting.
rkv 10y ago
> Binary package for OS X >= 10.7 But I get: > You have OS X 10.11.6. The application requires OS X 10.12 or later. ?? Edit: Looks like this is a known issue[1]. 1. https://github.com/keepassxreboot/keepassxc/issues/181 https://github.com/keepassxreboot/keepassxc/issues/181
reddotX 10y ago
on Ubuntu, "snap install keepassxc"
- arviewer 10y ago
  Too bad this isn't mentioned on the download page. I haven't used snaps until now, and I see there is no menu item. I can start via the terminal, and guess I have to add it to the menu myself.
  - jcastro 10y ago
    The snap should most certainly install an icon, could you file a bug? Thanks! https://bugs.launchpad.net/snapd https://bugs.launchpad.net/snapd
Unkechaug 10y ago
Finally! Very excited for an improved solution. It would be nice to have something like this on iOS and Android too, but at least my Mac and Windows computers will be able to play nice.
mierle 10y ago
I previously used KeePassX, which was great due to the multiplatform support. However the project seemed stalled, and I've since switched to the excellent KeeWeb; it's Electron based and is in general more modern. https://keeweb.info/ https://keeweb.info/
- eracors 10y ago
  How long have you been using this? I'm very interested in trying it, just a little worried about it's stability. I guess I'm slightly biased against Electron apps due to some bad experiences. I'm just worried it will corrupt the database or something. Have you experienced anything like that?
  - scott_karana 10y ago
    Not OP, but I've been using it for work passwords since spring 2016, and finally started using it personally in the last few months. I had one UI-related saving issue, but the creator quickly responded to the PR and fixed it in a later version. (Used KeePassX in both contexts previously)
- vidyesh 10y ago
  I will give this a try. I like the idea that despite being modern this doesn't send any requests and works offline. How has been your experience?
ubershmekel 10y ago
Bruce Scheneier designed Password Safe: https://pwsafe.org/ https://pwsafe.org/ It's not one multiplatform app, but there's an equivalent format app on every platform.
sschueller 10y ago
Here is the repository which isn't linked anywhere on the site: https://github.com/keepassxreboot/keepassxc https://github.com/keepassxreboot/keepassxc
- lps41 10y ago
  Yes it is, right at the top of the Download page: https://keepassxreboot.github.io/download https://keepassxreboot.github.io/download
  - the_duke 10y ago
    Yeah but I had to search for a few minutes before I found it too. There should be a clear and visible Github banner or big link with the logo.
    - nirv 10y ago
      You can file Issue/PR here: https://github.com/keepassxreboot/keepassxreboot.github.io https://github.com/keepassxreboot/keepassxreboot.github.io
    - Ajedi32 10y ago
      There's a GitHub icon in the upper-right corner which is visible on every page on the site.
      - nirv 10y ago
        I may be wrong, but it wasn't there several hours ago (also at the same time I couldn't find a repo link on the About page either). Currently I still find it not visible enough.
eriknstr 10y ago
Compiles and installs without trouble on FreeBSD 11.0. Great :D
mrich 10y ago
With my latest password overhaul I switched to the master password system, not requiring any compromisable database of passwords as with password managers: http://masterpasswordapp.com/ http://masterpasswordapp.com/ You can even implement the algorithm yourself if you don't trust the app (which does not require any permissions on Android).
- tuwtuwtuw 10y ago
  How does that work with stuff such as odd password complexity rules (such as only digits allowed), enforced rotation, leaked password etc? It sounds like it would need to store more state than a master password.
  - mrich 10y ago
    From the same (master password, site identifier) combination you can generate the most common passwords. The app has categories short, medium, long, max, PIN (4 digits), phrase. There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.
- pipework 10y ago
  Have you seen the comments for this[0] thread? * What happens when you need to change any single one of those passwords? Don't you need to change all of them? [0]: https://news.ycombinator.com/item?id=12889807 https://news.ycombinator.com/item?id=12889807 edit: "any single..." includes the master password itself & any of the individual site passwords for that master password.
  - mrich 10y ago
    There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.
herpderperator 10y ago
Awesome! I am a heavy user of KeePass, and I also use all three main operating systems regularly, so this has always been an annoying issue to have. I usually get around it by using KeePass2Android on my phone and typing out passwords by hand on the other device. Could be worse. I hope developing an official Android and iOS app is on the list. There are third party alternatives (such as the one I just mentioned), but if the goal is to be completely cross-platform then let's push those out too.
balajics 10y ago
Is there any enhancements in UI? I dont find any screenshot posted in the repo
- arviewer 10y ago
  I don't see a difference. But this is just a starting point I guess.
coding123 10y ago
I guess I can finally upgrade to the kdbx (v2) format. I had to use kdb because there was no good kdbx editor for OSX.
- stekern 10y ago
  KeePassX supports .kdbx and runs on macOS. - https://www.keepassx.org https://www.keepassx.org
jacobmischka 10y ago
I've been using Keeweb for the last year or so and I'm very happy with it. The mobile experience is a little subpar but it works fine in a pinch, and the integrated syncing with your own storage services is handy. https://keeweb.info https://keeweb.info
- patrickk 10y ago
  On iOS, I use MiniKeePass, as KeeWeb is compatible with KeePass databases. I sync by pushing the latest copy of the DB via iTunes maybe once a week, takes about 30 second. Maybe that helps.
  - jacobmischka 10y ago
    Thanks but I'm on Android and I sync using Google Drive. The two primary issues I have with KeeWeb on mobile are: - Typing my master password every time is tedious on a touchscreen, I really miss LastPass's fingerprint reader integration here. - The back button closes the app entirely, making me have to enter that tedious password again. This can be fixed be reworking the webapp to use the HTML5 history API, but just hasn't been done yet. Issue here https://github.com/keeweb/keeweb/issues/331 https://github.com/keeweb/keeweb/issues/331
    - patrickk 10y ago
      A quick google for "kdbx android" turns up this: http://www.keepassdroid.com/ http://www.keepassdroid.com/ Maybe that fixes the downsides of using KeeWeb on Android.
      - jacobmischka 10y ago
        Thanks, but this experience looks worse than KeeWeb, even with its couple downsides.
Roritharr 10y ago
While we're at it, is there any open source self-hosted alternative to LastPass etc.? At this point we'd even go so far as just using a good Keepass Client that comes with a comfortable "send encrypted password blob to xy email, than call him and tell him this decryption password"-function.
- davidroetzel 10y ago
  Read about passopolis (https://passopolis.com/ https://passopolis.com/) here on HN. It is a fork of mitro, a former lastpass competitor. A quick google search also turns up Passbolt (https://www.passbolt.com/ https://www.passbolt.com/). I cannot comment on either of them as I have not used them myself, but I would be interested if anyone has.
- creshal 10y ago
  Not that I'm aware of. There's a bunch of commercial ones, including ours, but development costs make it hard to just open source it if we don't have assurance that people will actually buy whatever value-added services around we can come up with.
  - Roritharr 10y ago
    Thats the usual chicken + egg problem. Thing is, i don't trust LastPass or any other commercial solution at all, because there is no public auditing possible. And LastPass has had breaches so there is precedence. But I really get where you are coming from, as we are also a SaaS Shop that has to walk that particular line.
- jbi 10y ago
  As KeePass uses a single (encrypted) file, you can use any hosting service that you want. Just make sure you save the new version back into your storage when you edit entries. You can use Owncloud, Google Drive, OneDrive, ...
  - zymhan 10y ago
    LastPass provides a web frontend though, which may be a feature GP is after. I mean, I think having a Web UI for your password manager is fucking insane, but some people like it.
Tepix 10y ago
I've been using Codebook (formerly known as STRIP) because it is partly open sourced, however they do not offer a desktop client for Linux and they only sync with commercial cloud services, so I'm looking for an alternative. Is there an overview that compares the various password managers out there?
- datashaman 10y ago
  https://en.wikipedia.org/wiki/Comparison_of_password_managers https://en.wikipedia.org/wiki/Comparison_of_password_manager...
stinos 10y ago
Anyone knows how this compares to KeePass (without any X suffixes)? (apart from that it has no binaries from Windows apparantly)
jl6 10y ago
I use KeepassX on my desktop PC and have been looking for an iOS app that can open the database. I found one but it occurred to me that I have no idea who wrote it or whether they can be trusted with my passwords. And iOS offers no way to prevent an app using the internet, so I couldn't be sure it wasn't leaking my passwords back to HQ - unlike on the (Linux) desktop where I can run it in an environment that I control (relatively speaking - no need to point out that I haven't personally audited the kernel). Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers?
- martinko 10y ago
  It's open source, feel free to audit and compile it yourself.
  - thinkmassive 10y ago
    He's questioning the trustworthiness of the unnamed iOS app, not KeePassX
  - jl6 10y ago
    Is there an open source iOS client? I would love to audit it but I lack both the time and knowledge. How would I verify that what I've audited is the source for the actual binary that the App Store delivers to my phone?
    - toyg 10y ago
      You can't. Welcome to the walled garden.
      - hav 10y ago
        You can compile and deploy the app yourself onto your devices with a free developer account. If the one-inch wall around the garden is too high, then maybe the garden isn't a place for you.
xorcist 10y ago
What are the benefits of using a "real" password manager, such as this one, compared to a plain encrypted file in vim? I thought that benefit was syncing across devices but it turns out the http feature of keepass wasn't implemented in all clients. How well specified is the kdbx format? Is there a console client? Is the code readable? Keepass seems to have spawned an entire ecosystem of tools and clients, so I'm curious which of these tools are actualy usable.
- jkgeyti 10y ago
  I can't speak to security, but from a functional standpoint the tree and key-value structure of password managers allows easier third party integration into browsers etc, compared to a flat file.
  - metachris 10y ago
    Also you have search and don't expose the other passwords as you would in a textfile. There is pretty good apps for Keepass, which offer a Keepass Keyboard so you don't need to use the clipboard (which can be read by any app on Android for instance).
- toyg 10y ago
  Can you share your encrypted vim file with others? (Honest question). Keepass can also enable browser autocompletion. Kbdx is actually very much underspecified, but it's not terribly difficult to reverse engineer apparently. The main problem (iirc) is that the most recent format version has extensions that very few clients understand. It's popular because it's the least common denominator for "cross-platform portable encrypted key-value local storage". The sync support missing is actually a feature for most users. There are much better alternatives when you trust a third-party server.
  - metachris 10y ago
    Syncing can be achieved by placing the password file in Dropbox or Google Drive.
po1nter 10y ago
ASnyone know why there's no Windows version yet? I'd like to know how this compares to the original .Net KeePass.
- jhoechtl 10y ago
  You mean the KeepassX which did not require .NET and was also cross-platform? https://www.keepassx.org/ https://www.keepassx.org/
  - roddux 10y ago
    I think perhaps po1nter meant the actual 'KeePass': http://keepass.info/ http://keepass.info/
  - po1nter 10y ago
    As roddux mentioned I'm talking about KeePass (the one at http://www.keepass.info http://www.keepass.info)
- Ajedi32 10y ago
  Huh? There _is_ a Windows version: https://keepassxreboot.github.io/download#windows https://keepassxreboot.github.io/download#windows
  - diggernet 10y ago
    ...and both download links there currently say "Unavailable".
hiq 10y ago
The reasons for the fork are explained in details there: https://github.com/keepassxreboot/keepassxc/issues/43#issuecomment-254045934 https://github.com/keepassxreboot/keepassxc/issues/43#issuec... It is rather worrying that they mention "keypasshttp" as being one of the pull request which was never merged, although it is all about functionality and not security, just to point out a few months after in another issue that users should stop using this plugin because of a vulnerability: https://github.com/keepassxreboot/keepassxc/issues/147#issuecomment-272525411 https://github.com/keepassxreboot/keepassxc/issues/147#issue... I don't really know how secure KeepassX is, but this fork doesn't look like it is any more secure, at least for the time being.
dr_hooo 10y ago
I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like a great idea to me, yet most people here seems to be prefer full blown PW manager apps or even online services for this. Am I missing something? [0] https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd?hl=en https://chrome.google.com/webstore/detail/password-hasher-pl...
- gliptic 10y ago
  The main problems I find with hashers are: * No way to change password without storing things * No way to handle site-specific rules without storing things * No way to store auxiliary data (URLs, usernames, etc.) * No way to see which sites you have accounts on
  - dr_hooo 10y ago
    Makes sense, from a usability PoV, thanks.
- netheril96 10y ago
  Because it also needs to store a database. No reduced complexity at all.
  - dr_hooo 10y ago
    In its most basic form it just requires a key file and an algorithm. But I agree that more complex operations need some DB.
- tscs37 10y ago
  I consider them more insecure than a reasonably well made password manager, all that is between you and any possible site you will ever register on or have registered on, is a master password. On the other hand, I can change my Lastpass/Keepass password regularly, denying a cracker access to my accounts in the future. The security of any password manager, including hashers, is not only how secure it is against attacks, but how secure it is after it has been successfully attacked and how easy it is to recover full security without losing too much data.
FatalBaboon 10y ago
Honestly, as a programmer/ops knowing git and always having a terminal somewhere around, I see no reason to use something else than https://git.zx2c4.com/password-store https://git.zx2c4.com/password-store It uses a git repo as storage, gpg encrypts passwords, provides perfect completion and there is an android app. Everything is dead simple and open source.
- michaelmior 10y ago
  Don't you find it annoying having to switch to a terminal to log in to a site in your browser? I personally love LastPass. It's free for my use case and there's plugins for popular browsers, mobile apps, and a CLI app if you really want it.
  - luca_ing 10y ago
    From the pass website[1]: -------------------- The community has even produced a cross-platform GUI client, an Android app, an iOS app, a Firefox plugin, Chrome plugin, a Windows client, a pretty Python QML app, a nice Go GUI app, an interactive console UI, Alfred integration (1) (2) (3), a dmenu script, OS X integration, git credential integration, and even an emacs package. -------------------- If this weren't the case, I'd agree :-) [1] https://www.passwordstore.org/ https://www.passwordstore.org/
    - compuguy 10y ago
      True, but the chrome plugin has issues (something to do with the native messaging executable not working): https://github.com/dannyvankooten/browserpass/issues/28 https://github.com/dannyvankooten/browserpass/issues/28
  - FatalBaboon 10y ago
    It's a feature, I don't want a third party addon of an app (even firefox) to fiddle with gpg and my passwords more than necessary.
    - 10y ago
Tepix 10y ago
Is there a password manager that can sync to WebDAV? Even if the data is encrypted, by using 3rd party services such as DropBox you risk someone trying to crack your passphrase without you noticing.
- NoGravitas 10y ago
  You can use KeePassX or its friends, and sync using Owncloud/Nextcloud. Those both use WebDAV for their syncing backends.
problems 10y ago
Does it support the new kdbx4 format which is using Argon2 instead of a custom AES-based KDF? Why should I move from KeePass2 to this? Prettier GUI under Linux?
- SadWebDeveloper 10y ago
  > Does it support the new kdbx4 ...? R: NO, https://github.com/keepassxreboot/keepassxc/issues/148 https://github.com/keepassxreboot/keepassxc/issues/148 > Why should I move from KeePass2 to this? R: KeePass 1.x and 2.x are the official KeePass releases, KeePassX is a community port in C++ originally built for Linux/Unix but now it includes builts for Windows too. Most people that recommend KeePassX over KeePass 2.x is because they are (.NET/Mono)fobics, plain paranoids or just haters of microsoft. KeePassX and KePassXC aren't improved versions of KeePass they are just ports to C++ (for Linux and Windows) of KeePass.
- louib 10y ago
  > Does it support the new kdbx4 format which is using Argon2 instead of a custom AES-based KDF? Not yet, but it's planned for the next release https://github.com/keepassxreboot/keepassxc/issues/148 https://github.com/keepassxreboot/keepassxc/issues/148
snockerton 10y ago
Looks like someone was willing to spend some time on an audit of the original KeePass: https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-security-vulnerabilities-found/ https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-...
Gelob 10y ago
I've been using Keepass Desktop which apparently isn't available for download anymore but it was much better than keepassx https://github.com/PixelPaws/KeePass-Desktop https://github.com/PixelPaws/KeePass-Desktop https://www.pixel-paws.de/en/ https://www.pixel-paws.de/en/
- compuguy 10y ago
  What happened to it?
- raphaelh 10y ago
  Could you elaborate a bit on why it was much better?
deleted 10y ago
[deleted]
tiatia 10y ago
How is the database stability of this program? The last password program I used had often, very often a corrupted database.
Asooka 10y ago
There's one thing I worry about with keeping all my passwords in a single file - if a government agent gains access to it, I'll have to decrypt it, which will reveal the password to my key, my key, and a full list to all web sites I have accounts at and a list of those accounts. Let's say you have an alt reddit account you use to post to /r/ihatedonaldtrump, congratulations, now the government knows with certainty that it was you. It's one thing to see your IP making requests to reddit.com - you can just give them your normal username and password, but with a single password file, you give them all your usernames and passwords. Maybe I'm overly paranoid, but I don't like keeping passwords to anything that might be remotely questionable in a normal encrypted password file. On the flip side, if the file in question contains an account to a questionable site, could you withhold the key/password to it under the clause against self-incrimination? I.e. you're sued for insulting Donald J. Trump's itty bitty tiny handsy-wandsies, but you also have an account at buymarijuanaonline.com, so you can't give them access to your password database, because you'll incriminate yourself in a different crime.
verandaguy 10y ago
Does this incorporate enough changes compared to KeePassX to warrant an audit?

385 points by karlgrz 10y ago

From the text it looks like one of the selling points is integration with apps like browsers so you don't have to copy/paste passwords, as with KeePassX. Personally, to me that sort of integration has always seemed like a bad idea. I'm glad that my password database can't talk to my browser programmatically. One less thing to go wrong.

dannysu 10y ago
You don't have to use it. Also, a recently landed change allows you to exclude that feature entirely from the compiled binary if you want to build it yourself. Personally the best feature I'm using KeePassXC for is the auto-reload feature. I sync my kdbx file with Tresorit across couple computers, and the auto-reload feature ensures that I'm always modifying the latest version. This is something lacking in the original KeePassX.
shmerl 10y ago
One thing that stands out is usage of Qt 5. KepassX (at least the released version) is still using Qt 4.
- smonff 10y ago
  It don't change drastically the features of the application.
  - favadi 10y ago
    Maybe with Qt5 it will scale correctly in HiDPI display?
dorkygator 10y ago
Yea, lastpass got burned by it with their chrome extension. After that, I switched from a web password manager to desktop password manager. Less attack surface area.
mcpherrinm 10y ago
Browser integration is one of the major security gains of using a password manager. It takes passwords and makes them "unphishable", because the manager knows what domain you're on. Of course it's also the largest attack surface. Personally, I think that tradeoff is worth it - assuming competent development.
- dotancohen 10y ago
  > assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.
  - farjar 10y ago
    If assuming competent development is bad, as you claim, why would it be a better idea to use a closed source password manager like LastPass instead of an open source fork of KeepassX? If this program can accomplish everything that LastPass can accomplish, while also being open source, surely that's more trust worthy then a closed source implementation that you could not audit.
    - dotancohen 10y ago
      I'm not interested in the closed- or open- source aspects of the issue. I'm interested in allowing other browser extensions to access my passwords. The issue is whether or not passwords should be stored in a browser extension, not about access to the source code.
- dotancohen 10y ago
  > assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.
- majkinetor 10y ago
  It also protects from keylogers.
est 10y ago
So you don't need a password manager. Just save to a encrypted txt file and grep them.
- nindalf 10y ago
  This isn't a great idea for a few reasons, but if you're looking for something like this, its possible to do it with a few lines of bash - Shitty Password Manager (https://github.com/nindalf/shitty-password-manager https://github.com/nindalf/shitty-password-manager)
- ynezz 10y ago
  I won't do this daily on my Android phone.
- snowwrestler 10y ago
  You can't grep for plaintext in an encrypted file. That's kind of the point of encryption.
  - loup-vaillant 10y ago
    $ decrypt psswd.txt | grep "mywebservice.com" Though now the password is displayed on the terminal... Not great, but better than exposing the whole database.
- kristjan 10y ago
  You may also dig https://www.passwordstore.org/ https://www.passwordstore.org/
jakeogh 10y ago
It is manipulating the clipboard and inserting keystrokes (to switch between text fields in the login box). Unfortunately any running X app can do that. I would like more isolation too. QubesOS is the only thing I know of that does it.
- noja 10y ago
  > any running X app can do that. Not on Wayland.
  - jakeogh 10y ago
    Cool. Found: http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and-how-to-handle/ http://mupuf.org/blog/2014/02/19/wayland-compositors-why-and... https://lwn.net/Articles/589147/ https://lwn.net/Articles/589147/
vanous 10y ago
I love browser integration but am not willing to go to lastpass, therefore have to stay with the ugly, but well functioning .NET keepass2 client on desktop and with the nice keepass2android. > From the text it looks like one of the selling points is integration with apps like browsers so you don't have to copy/paste passwords, as with KeePassX. Can you provide source please? thank you. This [1] says the opposite: (quoting from the github issue): "I removed the milestone for now since we are not sure if we actually want our users to expose their passwords over a network protocol with questionable security record. The security of both KeePassHTTP and KeePassRPC is doubtable and in their current state we would prefer not to have them as part of the main KeePassXC product. This doesn't mean KeePassXC will never support it, it only means that at the moment we don't have immediate plans and an implementation needs further discussion." [1] https://github.com/keepassxreboot/keepassxc/issues/88#issuecomment-272626610 https://github.com/keepassxreboot/keepassxc/issues/88#issuec...
- Nullabillity 10y ago
  Apparently it does support KeePassHTTP, if you recompile it with a special flag: https://keepassxreboot.github.io/project https://keepassxreboot.github.io/project
  - vanous 10y ago
    Yes, i just found it, thanks! Unfortunately, the on Firefox side, i can only use PassIFox extension, which has been too barebone to fit my needs. KeeFox has been excellent - especially if you have multiple accounts associated with single domain or even subdomains. What i use a lot is to open up a website with particular credentials (search in KeeFox by Ctrl-1) or to generate passwords (Ctrl-4) (good if you are the one making logins for other people).
- ComodoHacker 10y ago
  >the ugly, but well functioning .NET keepass2 What's ugly about it, besides (I guess) .NET part?
  - 10y ago
louib 10y ago
AFAIK KeePassHttp, which integrates which PassIFox for Mozilla Firefox and chromeIPass for Google Chrome, is not part of KeePassXC by default.

dublinben 10y ago

If you were curious like I was, about why this fork was necessary, I found this on their About page: KeePassXC is a community fork of KeePassX which aims to incorporate stalled pull requests, features, and bug fixes that have never made it into the main KeePassX repository.

sleavey 10y ago
Do you know why they have been stalled? Perhaps there's a good reason, like code auditing? Just a shot in the dark - I have no idea.
- roddux 10y ago
  Judging from TFA it's due to KeePassX having one maintainer, so the pull requests all bottleneck with him. Also mentioned is that one desirable outcome of this is that KeePassXC developers are given co-maintainer status of KeePassX and that they re-merge down the line.
  - shincert 10y ago
    That's cool. But if that's all this project is, couldn't they have just talked to the one maintainer and offer to help him and be on the team?
    - roddux 10y ago
      I would assume that avenue has been tried -- so this project is to pressurise him into opening up to the idea. No idea though.
    - zymhan 10y ago
      I wonder how often those conversations take place before someone(s) fork a project because it's "abandoned". But I love KeepassX and I'll certainly try using the fork.
    - thecardcheat 10y ago
      https://github.com/keepassxreboot/keepassxc/issues/43 https://github.com/keepassxreboot/keepassxc/issues/43 states the maintainer hasn't been commenting on PRs. I looked on the keepassx GitHub and some issues with no response are over 2 years old.

amluto 10y ago

I haven't tried it yet, but maybe this will address some of my pet peeves. My primary peeve is that, in keepassx, there is no fantastic way to handle password changes. I can generate a new password, but the only way to get it into a webpage without overriding the old password in the database is to show it on the screen and then copy the visible text. (My second peeve is that the "type the password" feature types the username and password, making it useless for the more annoying disabled-paste password prompts.)

dublinben 10y ago
Every entry should have a complete history of all passwords. I'm not sure why you'd be worried about the new password overwriting the old one. It's not gone forever. You can also customize the auto-type on a per site basis. Only the default types U + P. It can be anything you want it to be.
- acidburnNSA 10y ago
  Yes. For example, you use {PASSWORD}{ENTER} as the custom auto-type command for a simple password dialog.
- crypt1d 10y ago
  hmm I don't really see this feature in KeepassX, the history tab only shows changes to the entry name not the passwords. Am I missing something?
  - temprature 10y ago
    Select the old entry and click the "Show" button at the bottom, it takes you to the entry tab but with the old data in place so you can copy the old password.
Rovanion 10y ago
You can also precc Ctrl-c to copy the password of any entry. And I believe type the password can be configured since my keepassx doesn't do what you describe, it only types out the password.

shmerl 10y ago

The FAQ should explain the reason for the fork. I couldn't find anything about that, and that was the first question I had.

rcthompson 10y ago
The explanation is right here: https://keepassxreboot.github.io/project https://keepassxreboot.github.io/project But I agree, they should definitely link to it from the FAQ, since a lot of people are going to look there first.
- shmerl 10y ago
  Thanks for the pointer!

mmel 10y ago

I tried to stick with KeePass.x for the longest time, but keeping the keepass databases in sync across multiple platforms/devices, while possible, was very much a pain and quite a clunky/messy process which always required me to remember to do something after updating the database anywhere. I eventually gave up and migrated to Lastpass which "Just Works™" on all my devices.

dbg31415 10y ago
I also like how LastPass can be administered by company / team admins, has 2FA, allows you to share passwords (or groups of passwords) with people (or teams of people), has some built in tools to help automate password updates, and can give you a quick at a glance audit of which passwords are old / insecure / are used more than once / are used for services that have been reported hacked and should be changed. But... HackerNews hates LastPass for some reason... still haven't quite figured out why. (= It's a great service.
- r00fus 10y ago
  Perhaps because the concept of a cloud keychain is just too tempting for exploits? If someone gets my keychain they own me completely and can quite possibly ruin my life.
  - sthrs 10y ago
    You don't have to keep all of your credentials in LastPass. For example, I don't store any email credentials or important accounts such as Google or Microsoft. Everything else (like HN) is negligible if LastPass gets owned.
    - kakarot 10y ago
      So where is the benefit over keeping all of my passwords in a non-cloud storage solution with KeepassX2?
  - pixelcloud 10y ago

hailsaytan 10y ago

What happened to the Windows binaries?

zyxzkz 10y ago

Why not change the name entirely, then? KeepassX is already a terrible one. Makes me think of DOS software from 1998.

alanbernstein 10y ago
KeepassX is a clone/port of Keepass, if you weren't aware. Keepass is a decent name IMO.
- hughes 10y ago
  How about QuiPasse?
  - nerflad 10y ago
    Que pasa?
    - djazzy 10y ago
      Que se passe-t-il ?
cryptos 10y ago
I don't like the name, too. KeepassX is terrible and KeepassXC odd even worse. Maybe we should start a contest to find a better name.
smonff 10y ago
It will be renamed PoneyPass when it will be ported to Electron.
Grue3 10y ago
But DOS executable name can be maximum 8 characters, KeepassXC is too long.
- abrowne 10y ago
  KEEPSSXC.EXE

joelbondurant 10y ago

Cross-platform and no Android, interesting.

rkv 10y ago

> Binary package for OS X >= 10.7 But I get: > You have OS X 10.11.6. The application requires OS X 10.12 or later. ?? Edit: Looks like this is a known issue[1]. 1. https://github.com/keepassxreboot/keepassxc/issues/181 https://github.com/keepassxreboot/keepassxc/issues/181

reddotX 10y ago

on Ubuntu, "snap install keepassxc"

arviewer 10y ago
Too bad this isn't mentioned on the download page. I haven't used snaps until now, and I see there is no menu item. I can start via the terminal, and guess I have to add it to the menu myself.
- jcastro 10y ago
  The snap should most certainly install an icon, could you file a bug? Thanks! https://bugs.launchpad.net/snapd https://bugs.launchpad.net/snapd

Unkechaug 10y ago

Finally! Very excited for an improved solution. It would be nice to have something like this on iOS and Android too, but at least my Mac and Windows computers will be able to play nice.

mierle 10y ago

I previously used KeePassX, which was great due to the multiplatform support. However the project seemed stalled, and I've since switched to the excellent KeeWeb; it's Electron based and is in general more modern. https://keeweb.info/ https://keeweb.info/

eracors 10y ago
How long have you been using this? I'm very interested in trying it, just a little worried about it's stability. I guess I'm slightly biased against Electron apps due to some bad experiences. I'm just worried it will corrupt the database or something. Have you experienced anything like that?
- scott_karana 10y ago
  Not OP, but I've been using it for work passwords since spring 2016, and finally started using it personally in the last few months. I had one UI-related saving issue, but the creator quickly responded to the PR and fixed it in a later version. (Used KeePassX in both contexts previously)
vidyesh 10y ago
I will give this a try. I like the idea that despite being modern this doesn't send any requests and works offline. How has been your experience?

ubershmekel 10y ago

Bruce Scheneier designed Password Safe: https://pwsafe.org/ https://pwsafe.org/ It's not one multiplatform app, but there's an equivalent format app on every platform.

sschueller 10y ago

Here is the repository which isn't linked anywhere on the site: https://github.com/keepassxreboot/keepassxc https://github.com/keepassxreboot/keepassxc

lps41 10y ago
Yes it is, right at the top of the Download page: https://keepassxreboot.github.io/download https://keepassxreboot.github.io/download
- the_duke 10y ago
  Yeah but I had to search for a few minutes before I found it too. There should be a clear and visible Github banner or big link with the logo.
  - nirv 10y ago
    You can file Issue/PR here: https://github.com/keepassxreboot/keepassxreboot.github.io https://github.com/keepassxreboot/keepassxreboot.github.io
  - Ajedi32 10y ago
    There's a GitHub icon in the upper-right corner which is visible on every page on the site.
    - nirv 10y ago
      I may be wrong, but it wasn't there several hours ago (also at the same time I couldn't find a repo link on the About page either). Currently I still find it not visible enough.

eriknstr 10y ago

Compiles and installs without trouble on FreeBSD 11.0. Great :D

mrich 10y ago

With my latest password overhaul I switched to the master password system, not requiring any compromisable database of passwords as with password managers: http://masterpasswordapp.com/ http://masterpasswordapp.com/ You can even implement the algorithm yourself if you don't trust the app (which does not require any permissions on Android).

tuwtuwtuw 10y ago
How does that work with stuff such as odd password complexity rules (such as only digits allowed), enforced rotation, leaked password etc? It sounds like it would need to store more state than a master password.
- mrich 10y ago
  From the same (master password, site identifier) combination you can generate the most common passwords. The app has categories short, medium, long, max, PIN (4 digits), phrase. There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.
pipework 10y ago
Have you seen the comments for this[0] thread? * What happens when you need to change any single one of those passwords? Don't you need to change all of them? [0]: https://news.ycombinator.com/item?id=12889807 https://news.ycombinator.com/item?id=12889807 edit: "any single..." includes the master password itself & any of the individual site passwords for that master password.
- mrich 10y ago
  There also is a counter used for hashing. So for a new password you just increment the counter. Remembering the counter for every site sounds too complicated, but you could store that in a file without losing much (any?) protection.

herpderperator 10y ago

Awesome! I am a heavy user of KeePass, and I also use all three main operating systems regularly, so this has always been an annoying issue to have. I usually get around it by using KeePass2Android on my phone and typing out passwords by hand on the other device. Could be worse. I hope developing an official Android and iOS app is on the list. There are third party alternatives (such as the one I just mentioned), but if the goal is to be completely cross-platform then let's push those out too.

balajics 10y ago

Is there any enhancements in UI? I dont find any screenshot posted in the repo

arviewer 10y ago
I don't see a difference. But this is just a starting point I guess.

coding123 10y ago

I guess I can finally upgrade to the kdbx (v2) format. I had to use kdb because there was no good kdbx editor for OSX.

stekern 10y ago
KeePassX supports .kdbx and runs on macOS. - https://www.keepassx.org https://www.keepassx.org

jacobmischka 10y ago

I've been using Keeweb for the last year or so and I'm very happy with it. The mobile experience is a little subpar but it works fine in a pinch, and the integrated syncing with your own storage services is handy. https://keeweb.info https://keeweb.info

patrickk 10y ago
On iOS, I use MiniKeePass, as KeeWeb is compatible with KeePass databases. I sync by pushing the latest copy of the DB via iTunes maybe once a week, takes about 30 second. Maybe that helps.
- jacobmischka 10y ago
  Thanks but I'm on Android and I sync using Google Drive. The two primary issues I have with KeeWeb on mobile are: - Typing my master password every time is tedious on a touchscreen, I really miss LastPass's fingerprint reader integration here. - The back button closes the app entirely, making me have to enter that tedious password again. This can be fixed be reworking the webapp to use the HTML5 history API, but just hasn't been done yet. Issue here https://github.com/keeweb/keeweb/issues/331 https://github.com/keeweb/keeweb/issues/331
  - patrickk 10y ago
    A quick google for "kdbx android" turns up this: http://www.keepassdroid.com/ http://www.keepassdroid.com/ Maybe that fixes the downsides of using KeeWeb on Android.
    - jacobmischka 10y ago
      Thanks, but this experience looks worse than KeeWeb, even with its couple downsides.

Roritharr 10y ago

While we're at it, is there any open source self-hosted alternative to LastPass etc.? At this point we'd even go so far as just using a good Keepass Client that comes with a comfortable "send encrypted password blob to xy email, than call him and tell him this decryption password"-function.

davidroetzel 10y ago
Read about passopolis (https://passopolis.com/ https://passopolis.com/) here on HN. It is a fork of mitro, a former lastpass competitor. A quick google search also turns up Passbolt (https://www.passbolt.com/ https://www.passbolt.com/). I cannot comment on either of them as I have not used them myself, but I would be interested if anyone has.
creshal 10y ago
Not that I'm aware of. There's a bunch of commercial ones, including ours, but development costs make it hard to just open source it if we don't have assurance that people will actually buy whatever value-added services around we can come up with.
- Roritharr 10y ago
  Thats the usual chicken + egg problem. Thing is, i don't trust LastPass or any other commercial solution at all, because there is no public auditing possible. And LastPass has had breaches so there is precedence. But I really get where you are coming from, as we are also a SaaS Shop that has to walk that particular line.
jbi 10y ago
As KeePass uses a single (encrypted) file, you can use any hosting service that you want. Just make sure you save the new version back into your storage when you edit entries. You can use Owncloud, Google Drive, OneDrive, ...
- zymhan 10y ago
  LastPass provides a web frontend though, which may be a feature GP is after. I mean, I think having a Web UI for your password manager is fucking insane, but some people like it.

Tepix 10y ago

I've been using Codebook (formerly known as STRIP) because it is partly open sourced, however they do not offer a desktop client for Linux and they only sync with commercial cloud services, so I'm looking for an alternative. Is there an overview that compares the various password managers out there?

datashaman 10y ago
https://en.wikipedia.org/wiki/Comparison_of_password_managers https://en.wikipedia.org/wiki/Comparison_of_password_manager...

stinos 10y ago

Anyone knows how this compares to KeePass (without any X suffixes)? (apart from that it has no binaries from Windows apparantly)

jl6 10y ago

I use KeepassX on my desktop PC and have been looking for an iOS app that can open the database. I found one but it occurred to me that I have no idea who wrote it or whether they can be trusted with my passwords. And iOS offers no way to prevent an app using the internet, so I couldn't be sure it wasn't leaking my passwords back to HQ - unlike on the (Linux) desktop where I can run it in an environment that I control (relatively speaking - no need to point out that I haven't personally audited the kernel). Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers?

martinko 10y ago
It's open source, feel free to audit and compile it yourself.
- thinkmassive 10y ago
  He's questioning the trustworthiness of the unnamed iOS app, not KeePassX
- jl6 10y ago
  Is there an open source iOS client? I would love to audit it but I lack both the time and knowledge. How would I verify that what I've audited is the source for the actual binary that the App Store delivers to my phone?
  - toyg 10y ago
    You can't. Welcome to the walled garden.
    - hav 10y ago
      You can compile and deploy the app yourself onto your devices with a free developer account. If the one-inch wall around the garden is too high, then maybe the garden isn't a place for you.

xorcist 10y ago

What are the benefits of using a "real" password manager, such as this one, compared to a plain encrypted file in vim? I thought that benefit was syncing across devices but it turns out the http feature of keepass wasn't implemented in all clients. How well specified is the kdbx format? Is there a console client? Is the code readable? Keepass seems to have spawned an entire ecosystem of tools and clients, so I'm curious which of these tools are actualy usable.

jkgeyti 10y ago
I can't speak to security, but from a functional standpoint the tree and key-value structure of password managers allows easier third party integration into browsers etc, compared to a flat file.
- metachris 10y ago
  Also you have search and don't expose the other passwords as you would in a textfile. There is pretty good apps for Keepass, which offer a Keepass Keyboard so you don't need to use the clipboard (which can be read by any app on Android for instance).
toyg 10y ago
Can you share your encrypted vim file with others? (Honest question). Keepass can also enable browser autocompletion. Kbdx is actually very much underspecified, but it's not terribly difficult to reverse engineer apparently. The main problem (iirc) is that the most recent format version has extensions that very few clients understand. It's popular because it's the least common denominator for "cross-platform portable encrypted key-value local storage". The sync support missing is actually a feature for most users. There are much better alternatives when you trust a third-party server.
- metachris 10y ago
  Syncing can be achieved by placing the password file in Dropbox or Google Drive.

po1nter 10y ago

ASnyone know why there's no Windows version yet? I'd like to know how this compares to the original .Net KeePass.

jhoechtl 10y ago
You mean the KeepassX which did not require .NET and was also cross-platform? https://www.keepassx.org/ https://www.keepassx.org/
- roddux 10y ago
  I think perhaps po1nter meant the actual 'KeePass': http://keepass.info/ http://keepass.info/
- po1nter 10y ago
  As roddux mentioned I'm talking about KeePass (the one at http://www.keepass.info http://www.keepass.info)
Ajedi32 10y ago
Huh? There _is_ a Windows version: https://keepassxreboot.github.io/download#windows https://keepassxreboot.github.io/download#windows
- diggernet 10y ago
  ...and both download links there currently say "Unavailable".

hiq 10y ago

The reasons for the fork are explained in details there: https://github.com/keepassxreboot/keepassxc/issues/43#issuecomment-254045934 https://github.com/keepassxreboot/keepassxc/issues/43#issuec... It is rather worrying that they mention "keypasshttp" as being one of the pull request which was never merged, although it is all about functionality and not security, just to point out a few months after in another issue that users should stop using this plugin because of a vulnerability: https://github.com/keepassxreboot/keepassxc/issues/147#issuecomment-272525411 https://github.com/keepassxreboot/keepassxc/issues/147#issue... I don't really know how secure KeepassX is, but this fork doesn't look like it is any more secure, at least for the time being.

dr_hooo 10y ago

I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like a great idea to me, yet most people here seems to be prefer full blown PW manager apps or even online services for this. Am I missing something? [0] https://chrome.google.com/webstore/detail/password-hasher-plus-pass/glopbmohkffbnplcjbbbfmmimfhfnhgd?hl=en https://chrome.google.com/webstore/detail/password-hasher-pl...

gliptic 10y ago
The main problems I find with hashers are: * No way to change password without storing things * No way to handle site-specific rules without storing things * No way to store auxiliary data (URLs, usernames, etc.) * No way to see which sites you have accounts on
- dr_hooo 10y ago
  Makes sense, from a usability PoV, thanks.
netheril96 10y ago
Because it also needs to store a database. No reduced complexity at all.
- dr_hooo 10y ago
  In its most basic form it just requires a key file and an algorithm. But I agree that more complex operations need some DB.
tscs37 10y ago
I consider them more insecure than a reasonably well made password manager, all that is between you and any possible site you will ever register on or have registered on, is a master password. On the other hand, I can change my Lastpass/Keepass password regularly, denying a cracker access to my accounts in the future. The security of any password manager, including hashers, is not only how secure it is against attacks, but how secure it is after it has been successfully attacked and how easy it is to recover full security without losing too much data.

FatalBaboon 10y ago

Honestly, as a programmer/ops knowing git and always having a terminal somewhere around, I see no reason to use something else than https://git.zx2c4.com/password-store https://git.zx2c4.com/password-store It uses a git repo as storage, gpg encrypts passwords, provides perfect completion and there is an android app. Everything is dead simple and open source.

michaelmior 10y ago
Don't you find it annoying having to switch to a terminal to log in to a site in your browser? I personally love LastPass. It's free for my use case and there's plugins for popular browsers, mobile apps, and a CLI app if you really want it.
- luca_ing 10y ago
  From the pass website[1]: -------------------- The community has even produced a cross-platform GUI client, an Android app, an iOS app, a Firefox plugin, Chrome plugin, a Windows client, a pretty Python QML app, a nice Go GUI app, an interactive console UI, Alfred integration (1) (2) (3), a dmenu script, OS X integration, git credential integration, and even an emacs package. -------------------- If this weren't the case, I'd agree :-) [1] https://www.passwordstore.org/ https://www.passwordstore.org/
  - compuguy 10y ago
    True, but the chrome plugin has issues (something to do with the native messaging executable not working): https://github.com/dannyvankooten/browserpass/issues/28 https://github.com/dannyvankooten/browserpass/issues/28
- FatalBaboon 10y ago
  It's a feature, I don't want a third party addon of an app (even firefox) to fiddle with gpg and my passwords more than necessary.
  - 10y ago

Tepix 10y ago

Is there a password manager that can sync to WebDAV? Even if the data is encrypted, by using 3rd party services such as DropBox you risk someone trying to crack your passphrase without you noticing.

NoGravitas 10y ago
You can use KeePassX or its friends, and sync using Owncloud/Nextcloud. Those both use WebDAV for their syncing backends.

problems 10y ago

Does it support the new kdbx4 format which is using Argon2 instead of a custom AES-based KDF? Why should I move from KeePass2 to this? Prettier GUI under Linux?

SadWebDeveloper 10y ago
> Does it support the new kdbx4 ...? R: NO, https://github.com/keepassxreboot/keepassxc/issues/148 https://github.com/keepassxreboot/keepassxc/issues/148 > Why should I move from KeePass2 to this? R: KeePass 1.x and 2.x are the official KeePass releases, KeePassX is a community port in C++ originally built for Linux/Unix but now it includes builts for Windows too. Most people that recommend KeePassX over KeePass 2.x is because they are (.NET/Mono)fobics, plain paranoids or just haters of microsoft. KeePassX and KePassXC aren't improved versions of KeePass they are just ports to C++ (for Linux and Windows) of KeePass.
louib 10y ago
> Does it support the new kdbx4 format which is using Argon2 instead of a custom AES-based KDF? Not yet, but it's planned for the next release https://github.com/keepassxreboot/keepassxc/issues/148 https://github.com/keepassxreboot/keepassxc/issues/148

snockerton 10y ago

Looks like someone was willing to spend some time on an audit of the original KeePass: https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-security-vulnerabilities-found/ https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-...

Gelob 10y ago

I've been using Keepass Desktop which apparently isn't available for download anymore but it was much better than keepassx https://github.com/PixelPaws/KeePass-Desktop https://github.com/PixelPaws/KeePass-Desktop https://www.pixel-paws.de/en/ https://www.pixel-paws.de/en/

compuguy 10y ago
What happened to it?
raphaelh 10y ago
Could you elaborate a bit on why it was much better?

deleted 10y ago

[deleted]

tiatia 10y ago

How is the database stability of this program? The last password program I used had often, very often a corrupted database.

Asooka 10y ago

There's one thing I worry about with keeping all my passwords in a single file - if a government agent gains access to it, I'll have to decrypt it, which will reveal the password to my key, my key, and a full list to all web sites I have accounts at and a list of those accounts. Let's say you have an alt reddit account you use to post to /r/ihatedonaldtrump, congratulations, now the government knows with certainty that it was you. It's one thing to see your IP making requests to reddit.com - you can just give them your normal username and password, but with a single password file, you give them all your usernames and passwords. Maybe I'm overly paranoid, but I don't like keeping passwords to anything that might be remotely questionable in a normal encrypted password file. On the flip side, if the file in question contains an account to a questionable site, could you withhold the key/password to it under the clause against self-incrimination? I.e. you're sued for insulting Donald J. Trump's itty bitty tiny handsy-wandsies, but you also have an account at buymarijuanaonline.com, so you can't give them access to your password database, because you'll incriminate yourself in a different crime.

verandaguy 10y ago

Does this incorporate enough changes compared to KeePassX to warrant an audit?