4 ms·

Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me. Autofills my log

by icc97 10y ago

Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me. Autofills my logins and fully integrates with Firefoxes password manager so that you don't get conflicts between the browser and your password manager trying to save the same password. Also doesn't add the stupid CSS hacking that LastPass does to add their logo into the password fields breaking various site's styles. [0]: http://keepass.info/help/base/importexport.html

sillysaurus3 10y ago
Clickable: http://keepass.info/help/base/importexport.html http://keepass.info/help/base/importexport.html
ac29 10y ago
Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox. Sounds like a huge pain compared to LastPass, as well as increasing attack surface.
- tscs37 10y ago
  It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.
- icc97 10y ago
  LastPass is a Cloud password program + browser plugin So the extra layer is the plugin that is written by the same developer as the browser plugin. Which is a drop in plugin. It's all open source so it's much easier for people to check the vulnerabilities. It's also easier to raise issues and other people to help fix them. Separately Keepass is an offline database, so you have total control over access to it. The overhead of course is using something like Dropbox, plus probably Boxcryptor to ensure it's encrypted before it gets to Dropbox. I've commented elsewhere here - it's similar to the Keepass bazaar vs the LastPass cathedral. Keepass might look uglier, but I trust it more.
m3Lith 10y ago
For using with FF, I'd recommend KeeFox.
schmichael 10y ago
Keepass has lots of red flags for me: - No https on site - Update file hosted via http (not https) - Downloads via sourceforge which has injected adware in downloads before - FAQ downplays lack of constant time comparison instead of using constant time comparisons and being extra safe - You have to cobble together multiple apps from multiple developers to get a full working solution; means you have to trust lots of individual entities That being said I can hardly defend staying on Lastpass anymore. I just wish 1Pass was crossplatform so there was a clear universal winner!
- icc97 10y ago
  - No https, agree, its a very old site, but it's not sensitive material that you're submitting. You can check the integrity of the download [0] - Sourceforge, again not ideal but again it has very old beginnings from when Sourceforge was as respected as Github is. You can't blame the developer for the environment changing. Perhaps they're just a stickler for loyalty. I've never had any crapware with Keepass - FAQ - I could't find your reference in the FAQ page [1] - You have one app + plugin with a browser extension from two developers, hardly a mishmash. You know directly who those two developers are. You've no idea who was working on LastPass. I'd say it was more in the bazaar philosophy vs the LastPass cathedral. [0]: http://keepass.info/integrity.html [1]: http://keepass.info/help/base/faq_tech.html
- icc97 10y ago
  You can download the file via https [0], this is what the Chocolatey package does [1] [0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.35/KeePass-2.35-Setup.exe [1]: https://chocolatey.org/packages/keepass
- tripzilch 10y ago
  Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag. The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo. The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw). I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.

by icc97 10y ago

sillysaurus3 10y ago

Clickable: http://keepass.info/help/base/importexport.html http://keepass.info/help/base/importexport.html

ac29 10y ago

Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox. Sounds like a huge pain compared to LastPass, as well as increasing attack surface.

tscs37 10y ago
It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.
icc97 10y ago
LastPass is a Cloud password program + browser plugin So the extra layer is the plugin that is written by the same developer as the browser plugin. Which is a drop in plugin. It's all open source so it's much easier for people to check the vulnerabilities. It's also easier to raise issues and other people to help fix them. Separately Keepass is an offline database, so you have total control over access to it. The overhead of course is using something like Dropbox, plus probably Boxcryptor to ensure it's encrypted before it gets to Dropbox. I've commented elsewhere here - it's similar to the Keepass bazaar vs the LastPass cathedral. Keepass might look uglier, but I trust it more.

m3Lith 10y ago

For using with FF, I'd recommend KeeFox.

schmichael 10y ago

Keepass has lots of red flags for me: - No https on site - Update file hosted via http (not https) - Downloads via sourceforge which has injected adware in downloads before - FAQ downplays lack of constant time comparison instead of using constant time comparisons and being extra safe - You have to cobble together multiple apps from multiple developers to get a full working solution; means you have to trust lots of individual entities That being said I can hardly defend staying on Lastpass anymore. I just wish 1Pass was crossplatform so there was a clear universal winner!

icc97 10y ago
- No https, agree, its a very old site, but it's not sensitive material that you're submitting. You can check the integrity of the download [0] - Sourceforge, again not ideal but again it has very old beginnings from when Sourceforge was as respected as Github is. You can't blame the developer for the environment changing. Perhaps they're just a stickler for loyalty. I've never had any crapware with Keepass - FAQ - I could't find your reference in the FAQ page [1] - You have one app + plugin with a browser extension from two developers, hardly a mishmash. You know directly who those two developers are. You've no idea who was working on LastPass. I'd say it was more in the bazaar philosophy vs the LastPass cathedral. [0]: http://keepass.info/integrity.html [1]: http://keepass.info/help/base/faq_tech.html
icc97 10y ago
You can download the file via https [0], this is what the Chocolatey package does [1] [0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.35/KeePass-2.35-Setup.exe [1]: https://chocolatey.org/packages/keepass
tripzilch 10y ago
Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag. The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo. The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw). I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.