11 ms·
You can also add in KeepassHttp + PassIFox. But I wonder if these might have similar vulnerabilities as they too would be handling decrypted passwords.
by icc97 10y ago
You can also add in KeepassHttp + PassIFox. But I wonder if these might have similar vulnerabilities as they too would be handling decrypted passwords.
- compuguy 10y agoTrue, but there are a slew of security issues (and unknowns) with KeePassHttp: https://github.com/pfn/keepasshttp/issues/258 https://github.com/pfn/keepasshttp/issues/258 https://github.com/keepassxreboot/keepassxc/issues/147 https://github.com/keepassxreboot/keepassxc/issues/147 I've been looking for a alternative with somewhat parity with lastpass with a better security policy.
- kirushik 10y agoEnpass seems to be your (and mine) best choice at the moment. At least it's a standalone Qt application (not a JS-based browser one), with it's separate UI and without any autofills without asking. Bonus points for reasonably good integration with your usual clouds (Dropbox, GoogleDrive, OwnCloud, etc) for synchronization. Cons: NOT open-source, paid cellphone apps.
- icc97 10y agoThat #258 issue is for if you use it remotely - which by default it isn't and I don't. The other issue you raise is based on top of that. So as long as you're using KeepassHttp with localhost then you should be ok. So a slew is not necessarily accurate. But I take you're point, it's definitely a similar weak point that LastPass has.