5 ms·

I was just given a mac at work and haven't figured out how to integrate KeePass with Firefox on OSX. On Windows I was using KeeFox, but I can't find a mac clien

I was just given a mac at work and haven't figured out how to integrate KeePass with Firefox on OSX. On Windows I was using KeeFox, but I can't find a mac client that include KeePassRPC and the mono instructions didn't make sense. For now I'm using KeeWeb and manually copying entries. Suggestions?

Quiark 9y ago
Suggestion: don't use integration. The whole idea has a high risk of security compromise and the plugins I've seen were not implemented well. I use copy/paste or Autotype and don't find it slow to use at all.
- luma 9y ago
  So now all anyone needs to do is watch your clipboard? I'm not arguing your approach as I use Keepass in the same way, but I also know it'd be pretty straightforward to snarf my creds if you were able to watch my clipboard.
  - sprucely 9y ago
    Autotype bypasses the clipboard. It works well, particularly for those annoying login pages that prevent pasting from the clipboard.
    - luma 9y ago
      KeePass can do two-channel obfuscation where it mixes both clipboard and keystrokes, but both of these things are trivial to intercept.
  - blacksmith_tb 9y ago
    Not exactly - KeePassXC (and many of the other clients) do try to unset the clipboard. I think this is as much to save you from accidentally pasting a password into your browser's search box or a chat, but at least on OSX / macOS, it prevents a malicious script from using pbpaste to grab the last entry off the clipboard.
    - luma 9y ago
      KeePass does the same thing by default, but all you've done is create a race condition. Clipboard changes can be picked up by any application that cares to listen.
phit_ 9y ago
https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-connector/ https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-c... source: https://github.com/smorks/keepasshttp-connector https://github.com/smorks/keepasshttp-connector

5 ms·

I was just given a mac at work and haven't figured out how to integrate KeePass with Firefox on OSX. On Windows I was using KeeFox, but I can't find a mac clien

by liminal 9y ago

Quiark 9y ago
Suggestion: don't use integration. The whole idea has a high risk of security compromise and the plugins I've seen were not implemented well. I use copy/paste or Autotype and don't find it slow to use at all.
- luma 9y ago
  So now all anyone needs to do is watch your clipboard? I'm not arguing your approach as I use Keepass in the same way, but I also know it'd be pretty straightforward to snarf my creds if you were able to watch my clipboard.
  - sprucely 9y ago
    Autotype bypasses the clipboard. It works well, particularly for those annoying login pages that prevent pasting from the clipboard.
    - luma 9y ago
      KeePass can do two-channel obfuscation where it mixes both clipboard and keystrokes, but both of these things are trivial to intercept.
  - blacksmith_tb 9y ago
    Not exactly - KeePassXC (and many of the other clients) do try to unset the clipboard. I think this is as much to save you from accidentally pasting a password into your browser's search box or a chat, but at least on OSX / macOS, it prevents a malicious script from using pbpaste to grab the last entry off the clipboard.
    - luma 9y ago
      KeePass does the same thing by default, but all you've done is create a race condition. Clipboard changes can be picked up by any application that cares to listen.
phit_ 9y ago
https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-connector/ https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-c... source: https://github.com/smorks/keepasshttp-connector https://github.com/smorks/keepasshttp-connector