5 ms·
I use KeepassX on my desktop PC and have been looking for an iOS app that can open the database. I found one but it occurred to me that I have no idea who wrote
by jl6 10y ago
I use KeepassX on my desktop PC and have been looking for an iOS app that can open the database. I found one but it occurred to me that I have no idea who wrote it or whether they can be trusted with my passwords. And iOS offers no way to prevent an app using the internet, so I couldn't be sure it wasn't leaking my passwords back to HQ - unlike on the (Linux) desktop where I can run it in an environment that I control (relatively speaking - no need to point out that I haven't personally audited the kernel).
Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers?
- martinko 10y agoIt's open source, feel free to audit and compile it yourself.
- thinkmassive 10y agoHe's questioning the trustworthiness of the unnamed iOS app, not KeePassX
- jl6 10y agoIs there an open source iOS client? I would love to audit it but I lack both the time and knowledge. How would I verify that what I've audited is the source for the actual binary that the App Store delivers to my phone?
- toyg 10y agoYou can't. Welcome to the walled garden.
- hav 10y agoYou can compile and deploy the app yourself onto your devices with a free developer account. If the one-inch wall around the garden is too high, then maybe the garden isn't a place for you.
- throwanem 10y agoA free developer account and a Mac, since only a Mac will run the compiler and the code signer. Inch and a half, maybe, especially as I gather OS X virtualization is much improved since they started giving the OS away free.
- deleted 10y ago[deleted]
- davb 10y agoYes, MiniKeePass is open source.
- BinaryIdiot 10y ago> Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers? Hmm. Maybe? The trouble is at some point you have to trust someone and there isn't a good way to measure this. Even if the source of the iOS app was open (I don't know if it is, just a hypothetical) there is no guarantee that the source you looked at is the same that was used to compile the binary itself. I use one for iOS. I sure hope it's trustworthy. But if it isn't...well I don't really know where to turn to. LastPass? I tried them before but was amazing at how awful the UX was and I was too paranoid that someone would eventually find a flaw, get in and expose everyone's passwords ever because it's a cloud service...I am likely too paranoid.
- deleted 10y ago[deleted]
- jabagonuts 10y agoI've been complaining about the LastPass UX for years. Just in the past month I've noticed them start to quietly roll out improvements - one feature at a time. Gives me hope that in a few months the situation will be completely different. As for the trust thing, yeah... I don't even trust myself.
- manuw 10y agoI use MiniKeePass (https://github.com/MiniKeePass/MiniKeePass https://github.com/MiniKeePass/MiniKeePass) on iOS and keepassx2 on Linux. Works fine.
- zymhan 10y agoI can attest to MiniKeePass's quality. I've been using it for years now. I upload my keepass and key file to Dropbox (I know, I know) and then export them to MiniKeePass from the Dropbox app. MiniKeepass auto-associates the key file with the kdbx if it has the same filename as the kdbx, but with a .key extension. I can even edit the DB with Minikeepass and upload it back to Dropbox. It's not as sexy as an Android setup, but it works quite well for me.
- Andrenid 10y agoThis is my exact setup too. Perfectly happy with it. I do wish the iOS app could load my db file each time I start it but I also understand the reasons it can't so I'm ok with it.
- Florin_Andrei 10y agoI use the old KeePassX on Windows, Linux, and Mac. I use KeePassDroid on Android. The password database is shared via Dropbox. Works fine. The new fork is intriguing. Need to take a closer look.
- JustSomeNobody 10y agoI use this too, but I think the question was more about trust than works.
- evacchi 10y agoMiniKeePass but I also like KeePass Touch: built-in Dropbox/cloud sync and fingerprint to unlock the db (payed app, free with a banner otherwise)
- falsedan 10y agoMiniKeePass also has TouchID support & will load (not sync) from Dropbox et al.
- brennebeck 10y ago> And iOS offers no way to prevent an app using the internet You can disable an app's ability to connect via mobile data in Settings, though that doesn't solve the issue for using the app + wifi.
- netheril96 10y agoOn iOS 10 you can disable either or both cellular and Wi-Fi access for selected apps.
- chrizel 10y agoHow can this be set in iOS 10? I can only find the option to disable cellular for apps.
- JustSomeNobody 10y agoI am not seeing that option. Where is it located?
- Benjamin_Dobell 10y agoOn a related note. On Android "android.permission.INTERNET" is a normal permission and is automatically granted without prompting the user. However, it's explicitly included in an APK's manifest (use-permission) and Google's tools inject this automatically on your behalf. Does anyone know what happens if you remove the permission from an APK's manifest with apktool etc? For piece of mind it'd be nice to disable Internet access for certain apps. EDIT: I know there are solutions when rooted, and also virtual VPN solutions when not rooted. However, in the latter case you have to trust the VPN with all your traffic.
- noja 10y agoYour answer probably lies in this no-internet version of a popular keepass app for android: https://play.google.com/store/apps/details?id=keepass2android.keepass2android_nonet https://play.google.com/store/apps/details?id=keepass2androi...
- jmnicolas 10y agoI use a small paper notebook to store my passwords. That I can trust.
- Benjamin_Dobell 10y agoIf it's ciphered somehow, sure, why not? ;)
- jimhefferon 10y agoBut surely the danger feared by most people on computers is not people in their office peeking at their notebook to memorize a password or two? Surely the average person worried about their passwords has in mind the Bulgarian mafia getting all their passwords and ruining their life for some time to come? In that context, it seems to me, a paper solution is not totally daft.
- dfox 10y agoStoring passwords unencrypted on a piece of handwritten paper in your wallet is exactly what Bruce Schneier recommended few years ago.
- andai 10y agoReally? I googled to check but only found Password Safe.
- slau 10y agoThe rule of thumb that I apply is to use a very strong, very hard to remember vault password, and to write that down and store it with your taxes or something. The reasoning being that the thief breaking into your home doesn't care about a random sequence of characters, and how it might allow him to steal your online identity if he boots your computer and finds your vault file. He cares about the resell value of your camera, iPhone and maybe Macbook. Edit: I believe OP meant this article: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo...
- dannysu 10y agoYou're not overly paranoid. I compiled the open-source MiniKeePass iOS client myself. I don't install from the App Store because I can't know what's in those binary bits.
- sethammons 10y agohttps://www.keepassx.org/downloads https://www.keepassx.org/downloads I use the mac client. [edit]: oops, confused osx and ios. I'm not a mac person.
- iaml 10y agoI'm not sure if it will work, but you can give [1] a try. It's as opensource as it gets, works in browser and you can deploy it yourself on your own server. [1] https://app.keeweb.info/ https://app.keeweb.info/