4 ms·

Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeCli

Really good timing for me to self promote. :-) I'm working on improved keepassxc browser extension. Communication between browser and KeePassXC is via NativeClient. You need varjolintu fork of KeePassXC, but eventually it will also support KeePassHTTP protocol too. My goals currently are: internalization, nicer UI, clean and extensible code base. I already did options page with material-ui and react. Currently working on replacing jquery popup implentation for hyperapp, which appeared here on HN yesterday. If interested I can send instruction how you can build extentions. I would like to see this as official part of KeePassXC and willing to donate for free. What you guys think? You can try options UI on https://mauron85.github.io/keepassxc-browser/preview/ https://mauron85.github.io/keepassxc-browser/preview/

wh-uws 9y ago
awesome will definitely signup to be a beta test when you get it where you want that. actively using lastpass now and would like to move to an open source solution I feel like I can trust
- finchisko 9y ago
  You can go fully OSS already. Try https://github.com/pfn/passifox https://github.com/pfn/passifox. It is using KeePassXC http protocol. I'am working on it's replacement.
mosselman 9y ago
Any chance of creating an Opera version as well? I just force installed the chrome version on Opera, but it doesn't seem to work.
- finchisko 9y ago
  I'll take look. If Opera supports webextensions, then it should be viable.
varjolintu 9y ago
The official and latest version is always available here: https://github.com/varjolintu/keepassxc-browser https://github.com/varjolintu/keepassxc-browser Firefox Nightly (version 56) is also supported. The extension will work officially when Mozilla releases build 57.
Quiark 9y ago
A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al
- varjolintu 9y ago
  keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currently if there's any vulnerabilities, these are almost identical to chromeIPass' possible vulnerabilities.
  - sillysaurus3 9y ago
    Well, yes, that's the goal. But it's surprisingly easy to mess up. I think the people here are cautioning you not to get overconfident, and to make sure you research the details of the flaws in other systems.
    - varjolintu 9y ago
      It is easy to mess up, yes. I'm not overconfident, but almost the opposite. Without being totally paranoid, I'm usually pretty certain something important is forgotten. All help is welcome :)
  - gaia 9y ago
    chromeIPass' possible vulnerabilities being?
    - varjolintu 9y ago
StavrosK 9y ago
Can I talk to you about an idea I have regarding automating authentication extensions? There's no email in your profile, I'm afraid.
epistasis 9y ago
Have you considered dual browser extensions as in this paper: https://arxiv.org/abs/1706.05085 https://arxiv.org/abs/1706.05085 >The prototype Horcrux client, implemented as a Firefox add-on, is split into two components, with code that has access to the user's master's password and any key material isolated into a small auditable component, separate from the complexity of managing the user interface.
- varjolintu 9y ago
  Interesting idea. Gotta read the paper. Thank you.

wh-uws 9y ago

awesome will definitely signup to be a beta test when you get it where you want that. actively using lastpass now and would like to move to an open source solution I feel like I can trust

finchisko 9y ago
You can go fully OSS already. Try https://github.com/pfn/passifox https://github.com/pfn/passifox. It is using KeePassXC http protocol. I'am working on it's replacement.

mosselman 9y ago

Any chance of creating an Opera version as well? I just force installed the chrome version on Opera, but it doesn't seem to work.

finchisko 9y ago
I'll take look. If Opera supports webextensions, then it should be viable.

varjolintu 9y ago

The official and latest version is always available here: https://github.com/varjolintu/keepassxc-browser https://github.com/varjolintu/keepassxc-browser Firefox Nightly (version 56) is also supported. The extension will work officially when Mozilla releases build 57.

Quiark 9y ago

A few things to be wary of: * KeePassHTTP doesn't use authenticated encryption for its protocol and thus is insecure (decrypt password level insecure). Please make sure you don't have this issue. * Browser integration means there is only some JS code between my unlocked password vault and random websites. Please study findings from Tavis Ormandy and others who found such vulnerabilities in LastPass et al

varjolintu 9y ago
keepassxc-browser uses libsodium's box method for encrypting the messages. Only public keys are transferred between the extension and KeePassXC. You still need a valid private keys and a nonce for decrypting and encrypting the replies. You can read a more detailed description from the github page. I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currently if there's any vulnerabilities, these are almost identical to chromeIPass' possible vulnerabilities.
- sillysaurus3 9y ago
  Well, yes, that's the goal. But it's surprisingly easy to mess up. I think the people here are cautioning you not to get overconfident, and to make sure you research the details of the flaws in other systems.
  - varjolintu 9y ago
    It is easy to mess up, yes. I'm not overconfident, but almost the opposite. Without being totally paranoid, I'm usually pretty certain something important is forgotten. All help is welcome :)
- gaia 9y ago
  chromeIPass' possible vulnerabilities being?
  - varjolintu 9y ago

StavrosK 9y ago

Can I talk to you about an idea I have regarding automating authentication extensions? There's no email in your profile, I'm afraid.

epistasis 9y ago

Have you considered dual browser extensions as in this paper: https://arxiv.org/abs/1706.05085 https://arxiv.org/abs/1706.05085 >The prototype Horcrux client, implemented as a Firefox add-on, is split into two components, with code that has access to the user's master's password and any key material isolated into a small auditable component, separate from the complexity of managing the user interface.

varjolintu 9y ago
Interesting idea. Gotta read the paper. Thank you.