10 ms·

KeePassXC 2.3.0 released

189 points by louib 9y ago

nathan_long 9y ago
Anybody use this along with a non-tech significant other? How does it compare to commercial password managers in terms of usability?
- codemac 9y ago
  Without syncing or shared folders, I haven't tried it.
  - the_af 9y ago
    You can sync it over Dropbox or a similar service. I actually prefer it that way, since it decouples the password manager from the syncing/sharing service.
- kuon 9y ago
  I currently use KeePass (regular one, not XC) with a trigger to sync with dropbox. It works very well to share passwords with my wife but it requires a bit of effort to setup (I mean for non tech people). I have not tried KeePassXC yet (I'm under Windows), but I wonder how it compares for this kind of setup.
- AndyMcConachie 9y ago
  I trained my parents to use KeePassX 2.0 and they do OK with it. They're very tech non-savy but do fine with it because they only have to remember one password. I also made sure they use Timemachine for OSX so they don't lose their database. Prior to this they had a physical notebook and sticky notes with passwords written on them.
- paulryanrogers 9y ago
  Usability is too low, unapproachable for non techies. Even my somewhat technical spouse found it unusable after a few months. It could be better with good browser plugins, but then you have the same security tradeoffs as more polished services like Bitwarden or LastPass.
  - m_t 9y ago
    I use KeeFox with it and really find it good (even better with the latest update, that made it compatible with Chrome as well)
  - drdaeman 9y ago
    > but then you have the same security tradeoffs as more polished services like Bitwarden or LastPass. Not exactly. The database is handled with an independent program. With the new model, AFAIK, the browser extensions have no idea what records exist and can only query - and record matching is actually authenticated before plugin sees anything.
  - piracykills 9y ago
    Wasn't it shown recently that LastPass literally downloads JS from their servers to run on specified pages for compatibility? I suppose that's good for ease of use, but pretty scary from a security tradeoffs perspective and indeed KeePassHttp doesn't require you to make any sort of tradeoff like that.
  - adrianmonk 9y ago
    > with good browser plugins This latest version KeePassXC has a whole new browser plugin: https://github.com/keepassxreboot/keepassxc-browser https://github.com/keepassxreboot/keepassxc-browser So maybe it has reached that point now? Not that I've tried it, but it's at least promising that they've been working on it.
- Spooky23 9y ago
  It's not too bad at all. You need to walk through it with many users. My wife, parents and in-laws all use it. The only thing that is a gotcha is sync. It's isn't obvious to folks that when you open a synced vault on an iOS device that it may not sync back.
zaarn 9y ago
KPXC is currently my favorite password manager. Much more portable than Keepass itself (Mono, lots of plugins just don't work). I do recommend that anyone without PW manager atm either try KPXC or Keepass itself. It's worth it for your security.
alfuananzo 9y ago
Is it worth to migrate from Keepass2 to this? Any interesting user experiences?
- mih 9y ago
  On Linux it made a big difference, esp. because KPXC does not require Mono. The GUI feels more natural, is stable and plays well with the system tray (which was a sore point with KP2). On Windows, KPXC might actually be a step backward since KP2 is quite stable and has more plugins. I'm not sure which is more secure between the two.
- scrollaway 9y ago
  Yeah, it is. KeepassXC supports 2FA. (Note however that keeping your 2FA seeds in the same database as your passwords reduces the security aspect of a second factor)
- Ajedi32 9y ago
  I'm strongly considering it just based on the community surrounding each project. KeePass 2 seems to still be hosted on Sourceforge, and I'm not even sure where to get a copy of the latest (non-release) version of the source. The [Sourceforge repo][1] seems to be an outdated SVN repo which was last updated in 2009, and I don't see any description of how to contribute code to the project anywhere. As a result I'm not really sure how to gauge the level of activity on the project itself. Similarly, the website is ancient and doesn't seem to have kept up with the times; I seem to recall it was only recently that it even got HTTPS support. In contrast, KeePassXC is hosted on GitHub, development is done out in the open, and it's trivial to see that in just the last year there were [dozens of individual contributors][2]. The website looks clean, is user-friendly with up-to-date documentation, and a [contribution guide][3] is plainly visible in the README on GitHub. As a result, I feel a bit better about the long-term prospects of KeePassXC over KeePass 2. [1]: https://sourceforge.net/p/keepass/code/HEAD/tree/ https://sourceforge.net/p/keepass/code/HEAD/tree/ [2]: https://github.com/keepassxreboot/keepassxc/graphs/contributors?from=2017-02-26&to=2018-02-28&type=c https://github.com/keepassxreboot/keepassxc/graphs/contribut... [3]: https://github.com/keepassxreboot/keepassxc#contributing https://github.com/keepassxreboot/keepassxc#contributing
minimaxir 9y ago
Previous thread about KeepPassXC 2.2.0: https://news.ycombinator.com/item?id=14633576 https://news.ycombinator.com/item?id=14633576 I used KeePassXC for a period, but from these release notes, the UI/UX still isn't great. If you're on macOS, I recommend MacPass, which feels more native to the system, is compatible with existing KBDX databases and most-importantly, is also open-source: https://github.com/MacPass/MacPass https://github.com/MacPass/MacPass
- tripzilch 9y ago
  I was a little confused by your comment at first, maybe you didn't intend it that way, but I got the impression that you meant MacPass is open source, unlike KeePassXC. Except that KeepassXC is in fact open source: https://github.com/keepassxreboot/keepassxc/ https://github.com/keepassxreboot/keepassxc/ I suppose you meant that MacPass is open source, unlike some other Mac password managers? I didn't really check until someone downthreads mentioned that KeePassXC is (basically) a superset of KeePassX, which I know is open source because I use it as my password manager. So that means it's time for me to check out KeePassXC :) See what it does for me :)
- vetinari 9y ago
  I just switched from MacPass to KeePassXC for the reason mentioned in release notes: it obsoletes the HTTP Connector and uses another mechanism. MacPass keeps using HTTP, and it is uknown, when it will do the same switch. Given that I use multiple computers, and the extensions are synced, I want to use the same mechanism on all of them.
  - scrollaway 9y ago
    Do you know the details of the differences between the old and the new mechanisms? All I see is a migration is required, but I used neither.
    - vetinari 9y ago
      The new mechanism uses Native Messaging[0], with the native application being keepassxc-proxy. The old one used HTTP, with the server (the password manager) listening on localhost. [0] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na...
piracykills 9y ago
> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome. Congrats on the release.
- guessmyname 9y ago
  Last week I started reverse engineering the KDBX 3.1 file format (for fun). Does anyone knows where is the specification for KDBX 4.0? EDIT: Found it — https://github.com/keepassxreboot/keepassxc-specs https://github.com/keepassxreboot/keepassxc-specs
  - danesparza 9y ago
    This link also talks about changes to the spec for 4.x (but in more general terms): https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html
  - agildehaus 9y ago
    I don't believe the XML format has changed at all. Just the key derivation, stream cipher, and some changes to the binary header.
    - hacking_nomad 9y ago
      The XML Format has changed. Entries and Groups now support custom data. This was only supported on the database in KDBX3.1. Also, the settings now have a modified date which makes synchronising them when merging databases a lot easier. The other changes are done to the binary format as you say. Also to make the file smaller, attachments are now stored compressed "as is" instead of encoding them in base64 and adding them to the XML structure.
- minimaxir 9y ago
  What are the advantages/disadvantages of using Argon2/ChaCha20 over the current AES implementation? What are good parameters for those algos?
m-p-3 9y ago
The Chrome Web Store link seems to 404. https://chrome.google.com/webstore/detail/keepassxc-browser/iopaggbpplllidnfmcghoonnokmjoicf https://chrome.google.com/webstore/detail/keepassxc-browser/...
- m-p-3 9y ago
  Looks like the link in the github repo isn't up to date, here's another one I've found https://chrome.google.com/webstore/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk https://chrome.google.com/webstore/detail/keepassxc-browser/...
- deleted 9y ago
  [deleted]
therealmarv 9y ago
is it stable again? Last version was constantly crashing when modifying a new passwort entry again. This is something which is unacceptable for a password manager IMHO.
- mdaniel 9y ago
  Did you file an issue over that behavior?
  - therealmarv 9y ago
    the bug is still there. 2.3 can still crash after creating a new entry and reedit the password. I will try to reproduce the error with a new kdbx and report the bug.
076ae80a-3c97-4 9y ago
I highly recommend https://keeweb.info/ https://keeweb.info/ if you're looking for an attractive, easy to use, cross-platform and Open Source solution. I've been using it on Windows and MacOS for years without any major issues. It's by far the best looking front-end for keepass databases I've seen.
- agildehaus 9y ago
  Unfortunately it's slow as hell. KDBX4 file, ChaCha20/Argon2 30 rounds, that takes under a second to open in KeePassXC took 10 seconds in this app. Electron apps ...
- kayman 9y ago
  +1 for keeweb. It's central to my password management strategy now. Can't recommend it enough. I've tried the offline versions, but I find myself often on the go - without my laptop. The tools for mobile don't seem to support updates - read only. Keeweb does both.
- franga2000 9y ago
  I love KeeWeb, especially when used together with Nextcloud. I can access my passwords in a buch of different ways, all synced and all secure (the kdbx has a password and a file key). 1. In KeeWeb from inside Nextcloud (there's an app) 2. In external KeeWeb over WebDAV (great when using it as a PWA) 3. In KeePass proper using desktop file sync 4. In a KeePass-compatible app from the Nextcloud app All of these sound janky, but they work better that any other free software self-hosted cloud password manager.
TorKlingberg 9y ago
I currently use KeePass2 + Dropbox + Kee (Firefox) + MiniKeePass (iOS). Can KeePassXC + plugins replace those, and what are the advantages?
- nwah1 9y ago
  The announcement mentioned that they just released a new Firefox addon called KeepassXC-Browser. KeepassXC doesn't work on iOS. It is just a replacement for KeePass2
- StavrosK 9y ago
  KeePassXC can read KeePass2, so it only needs to replace that. That said, I haven't found a Kee replacement I like, so I'm still on KeePass2 (and it's fine for my needs).
JamesCoyne 9y ago
Anybody have thoughts about where to store the encrypted database for backup? Would it be foolish to keep the database somewhere publicly accessible?
- scrollaway 9y ago
  It's not ideal for your encrypted db to leak because, should you mistakenly leak your master password (which can happen simply through a keylogger for example), all the contents are now at risk. However, something like Google Drive is fine. Trust Google engineers to secure your data. Dropbox also fine if you don't like Google.
  - JamesCoyne 9y ago
    This makes sense. Presently my database lives on dropbox and is not in view of the public.
- avuton 9y ago
  I store mine on a personal NextCloud with davfs, but any secure online storage should do.
- nas 9y ago
  I store the .kdbx (database) file on a network synced folder (e.g. like dropbox or gdrive). However, I use a "key file" in addition to a password. The key file is not synced and remains on computers that I control. I also have a backup copy on external media.
  - fauigerzigerk 9y ago
    Aren't you worried about that fact that any program you run could potentially read all your passwords using the key file?
    - Macha 9y ago
      You can have a composite password to unlock consisting of keyfile + passphrase.
scrollaway 9y ago
Since it got a lot of positive attention last time, here's a rough guide on getting started with password management, aimed at readers here who are not currently using a password manager: https://leclan.ch/password-managers/ https://leclan.ch/password-managers/ TLDR: Download KeepassXC and start using it. :)
- zouhair 9y ago
  What does it do that Keepass/KeepassX cannot do? I looked at their website and nothing new shows up.
  - scrollaway 9y ago
    I address that at the bottom of my post. Keepass is the original, KeepassX is the Qt rewrite. KeepassXC got Qt 5 support, a bunch of misc QOL improvement patches, is actively maintained (unlike KeepassX) and also received some nice extra features such as TOTP 2FA support. It's a superset of KeepassX, so there's no real reason to use KeepassX at this point.
bdz 9y ago
Is it worth moving to this from 1Password? I mean I don't have any problems at all tho I use an old version (6 on Mac, 4 on Win), the permanent license version not this new subscription. I was thinking to use this with Dropbox, Chrome, and iOS client (MiniKeePass?)
- xylia 9y ago
  I suggest using Bitwarden (open source) instead. See my article: https://greycoder.com/bitwarden-excellent-free-password-manager/ https://greycoder.com/bitwarden-excellent-free-password-mana...
  - drdaeman 9y ago
    The linked article is very light on details to be called a comparison. Let me try to make it a little bit more detailed. ==================== Bitwarden: - Is essentially a service (with FLOSS client software and FLOSS server code). - Quite polished browser integration (to the extent browsers allow it). - Third party server holding the encrypted data. Proprietary (in a "completely unique, not compatible with anything else" sense) sync protocol. - Symmetric encryption key is encrypted with master key but it is NOT changed (with re-encrypting all the entries) when master password is changed. I'm not sure if there is an option to re-encrypt the data in case the symmetric key is compromised, although this should be doable via APIs. - Data is encrypted and signed, but some of the data structure (folder layout, TOTP existence, revision dates) is (theoretically) accessible to the service owners. Check out snippets at https://github.com/jcs/bitwarden-ruby/blob/master/API.md https://github.com/jcs/bitwarden-ruby/blob/master/API.md for info. - Has some nice extras built-in, like domain equivalence logic. - Self-hosted option is available (official Docker images using .NET Core and Microsoft SQL Server and unofficial third-party implementation in Ruby). I'm not sure how this works with licensing. ==================== Keepass: - Is primarily a standalone application. Or, better say, applications, as there are multiple independent implementations for many platforms. - Has browser integration, but all options (KeepassXC-Browser and PassIFox) are feel somewhat less polished. - Has composite credentials (in addition or instead of master password it can use i.e. keyfiles). Supported mechanisms vary with implementation. - If the encryption keys are compromised you can trivially re-encrypt the database to avoid further leaks. - File format is essentially a large encrypted and signed XML file (data block) with some extensible header that defines the crypto details. https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html - You handle the sync however you want it. For KeepassXC you need make database available in a filesystem. For Keepass and Android app there are also SFTP, WebDAV, Dropbox, Google Drive and some other options available. The only sync that's in the app is a logic for merging databases. ==================== Please correct me if I got something wrong. Thanks.
SCdF 9y ago
Does anyone know of an iOS client that supports Argon2? The amazing Keepass2Android already supports it, but I can't move to it until there is also an iOS solution…
dlandis 9y ago
Does anyone know what the license is for this software? It looks like there are NINE different license files in the repo: https://github.com/keepassxreboot/keepassxc https://github.com/keepassxreboot/keepassxc Did they just copy paste every different license they could find into the repo?
- Jeaye 9y ago
  https://keepassxc.org/ https://keepassxc.org/ > The full source code is published under the terms of the GNU General Public License. We see open source as a vital prerequisite for any security-critical software product. For that reason, KeePassXC is and always will be free as in freedom (and in beer). Contributions by everyone are welcome!
- pfg 9y ago
  Not all parts of the source code are available under the same license. The individual source code files include the applicable license. Doing this is fine for compatible licenses and not unusual for projects, though it can make certain things more complicated. Here's an example of what GNU says about GPL compatibility[1] - roughly meaning the whole work is published as GPL. [1]: https://www.gnu.org/licenses/gpl-faq.html#WhatDoesCompatMean https://www.gnu.org/licenses/gpl-faq.html#WhatDoesCompatMean
- deleted 9y ago
  [deleted]
- th3zero 9y ago
  KeePassXC maintainer here. This comment is really funny and made me laugh. Anyway we are following the Debian guidelines. The full copyright for each component and file is specified in the COPYING file in the root of the repository along side with each author.
awill 9y ago
I was a longtime user of KeePassX. The UI was terrible, but it was free, open source and most importantly cross platform. After KeePass2 made the DB incompatible and rewrote everything in C# it stopped being a proper cross platform product and I investigated aternatices. I've since moved to enpass and I'm very happy. Enpass is a great, native app on Win/Mac/Linux and has native Android/iOS apps (with fingerprint support etc..). Great UI, no subscription fees, no cloud hosting (though it syncs to your personal dropbox, gDrive, OwnCLoud etc..). I couldn't ask for more.
- tmikaeld 9y ago
  Only problem with it as i see it, it's closed source. I switched to Bitwarden for that reason alone. With that said, Bitwarden has it's issues: https://github.com/bitwarden/browser/issues/77 https://github.com/bitwarden/browser/issues/77
- satish-setty 9y ago
  > I was a longtime user of KeePassX. Probably you mean KeePass (the "original" one), which is written in C# and requires Mono in Linux ? KeepassX has always been native C++ and cross-platform.
shmerl 9y ago
Great replacement for keepassx which got stuck with Qt 4 forever.
ff_ 9y ago
The best UX improvement in this release (IMHO) is pretty buried in the changelog, and I don't see it mentioned here: no more lock files! If you use Keepass on something like Dropbox it's a blessing.
- softawre 9y ago
  Nice! This was one of two or three reasons I bit the bullet and switched to 1password yearly.
- TacticalMalice 9y ago
  The mentioned issue has the following statement which makes me wonder whether concurrent use on sync services is supported atm: > I was going to add tests for "concurrent" access of the same file in phase 2 of these changes. Phase 2 is refactoring the saving process entirely to make it asynchronous and robust to file sync services.
  - zaarn 9y ago
    From my experience, it already works somewhat. Atleast, whenever I overwrote the file in Nextcloud and my desktop pulled the update, it would merge the changes automatically.
nmy 9y ago
Remove lock file [#1231] is a good one for the ones who sync their KPXC databases between devices
znpy 9y ago
Serious question: why should I leave KeePassX ?
- sigzero 9y ago
  Q: Why KeePassXC instead of KeePassX? A: KeePassX is an amazing password manager, but hasn't seen much active development for quite a while. Many good pull requests were never merged and the original project is missing some features which users can expect from a modern password manager. Hence, we decided to fork KeePassX to continue its development and provide you with everything you love about KeePassX plus many new features and bugfixes.
- Sylos 9y ago
  It's in my opinion just a straight upgrade from KeePassX. Not a significant upgrade, but switching is probably not going to require significant effort either.
diimdeep 9y ago
UI/UX is terrible, I suggest try MacPass or KeeWeb
eikenberry 9y ago
I always find it interesting to see which of the new distro agnostic packages these applications provide. In this case AppImage and Snap. It really looks like AppImage is taking the lead among these new packaging technologies. When the project does provide these sorts of packages you always see AppImages, but rarely see Snap or Flatpak based images.
teilo 9y ago
The thing that keeps me in 1Password is its Team Vault support. Nothing works quite so well for maintaining a shared password vault. If I didn't need that, I'd drop 1Password for KeePass in a heartbeat.
- wheresvic1 9y ago
  Why not just make a keypass db for your shared passwords, put it on dropbox and share it with your team? Or put it in git even, if you want better traceability.
sapphire_tomb 9y ago
I really wanted to switch to using KeePassXC instead of the original one, as it's definitely a better user experience for the most part when you're flipping between OSes (Windows 10 and various Linux distros in my case). But my workflow requires I keep my kdbx in a git repo in order to sync between work and home, and I cannot get used to the missing "Synchronise with File" feature, which the original Keepass has, but KeePassXC omits.
cryptos 9y ago
I'd prefer if a password would be generated by default, when you create a new entry. That's the way KeePass works and it encourages to use strong generated passwords (instead of user created passwords). Another thing I'd like to have is a details view for each key in the list view (https://keepassxc.org/images/screenshots/linux/screen_002.png https://keepassxc.org/images/screenshots/linux/screen_002.pn...). Something like the bottom panel here: https://keepass.info/screenshots/keepass_2x/main_big.png https://keepass.info/screenshots/keepass_2x/main_big.png (but please more beautiful). I have a scenario where I need an additional authentifiction factor besides that password that I store in KeePassXC, too.
- varjolintu 9y ago
  Actually, there is a details view. Check the settings if it's disabled.
kertis 9y ago
Actually it's cool that it was forked. But qt5 apps have pretty bad fonts view on my xfce desktop especially with black themes like Ark dark. That's why I am on KeepassX so far.

189 points by louib 9y ago

Anybody use this along with a non-tech significant other? How does it compare to commercial password managers in terms of usability?

codemac 9y ago
Without syncing or shared folders, I haven't tried it.
- the_af 9y ago
  You can sync it over Dropbox or a similar service. I actually prefer it that way, since it decouples the password manager from the syncing/sharing service.
kuon 9y ago
I currently use KeePass (regular one, not XC) with a trigger to sync with dropbox. It works very well to share passwords with my wife but it requires a bit of effort to setup (I mean for non tech people). I have not tried KeePassXC yet (I'm under Windows), but I wonder how it compares for this kind of setup.
AndyMcConachie 9y ago
I trained my parents to use KeePassX 2.0 and they do OK with it. They're very tech non-savy but do fine with it because they only have to remember one password. I also made sure they use Timemachine for OSX so they don't lose their database. Prior to this they had a physical notebook and sticky notes with passwords written on them.
paulryanrogers 9y ago
Usability is too low, unapproachable for non techies. Even my somewhat technical spouse found it unusable after a few months. It could be better with good browser plugins, but then you have the same security tradeoffs as more polished services like Bitwarden or LastPass.
- m_t 9y ago
  I use KeeFox with it and really find it good (even better with the latest update, that made it compatible with Chrome as well)
- drdaeman 9y ago
  > but then you have the same security tradeoffs as more polished services like Bitwarden or LastPass. Not exactly. The database is handled with an independent program. With the new model, AFAIK, the browser extensions have no idea what records exist and can only query - and record matching is actually authenticated before plugin sees anything.
- piracykills 9y ago
  Wasn't it shown recently that LastPass literally downloads JS from their servers to run on specified pages for compatibility? I suppose that's good for ease of use, but pretty scary from a security tradeoffs perspective and indeed KeePassHttp doesn't require you to make any sort of tradeoff like that.
- adrianmonk 9y ago
  > with good browser plugins This latest version KeePassXC has a whole new browser plugin: https://github.com/keepassxreboot/keepassxc-browser https://github.com/keepassxreboot/keepassxc-browser So maybe it has reached that point now? Not that I've tried it, but it's at least promising that they've been working on it.
Spooky23 9y ago
It's not too bad at all. You need to walk through it with many users. My wife, parents and in-laws all use it. The only thing that is a gotcha is sync. It's isn't obvious to folks that when you open a synced vault on an iOS device that it may not sync back.

zaarn 9y ago

KPXC is currently my favorite password manager. Much more portable than Keepass itself (Mono, lots of plugins just don't work). I do recommend that anyone without PW manager atm either try KPXC or Keepass itself. It's worth it for your security.

alfuananzo 9y ago

Is it worth to migrate from Keepass2 to this? Any interesting user experiences?

mih 9y ago
On Linux it made a big difference, esp. because KPXC does not require Mono. The GUI feels more natural, is stable and plays well with the system tray (which was a sore point with KP2). On Windows, KPXC might actually be a step backward since KP2 is quite stable and has more plugins. I'm not sure which is more secure between the two.
scrollaway 9y ago
Yeah, it is. KeepassXC supports 2FA. (Note however that keeping your 2FA seeds in the same database as your passwords reduces the security aspect of a second factor)
Ajedi32 9y ago
I'm strongly considering it just based on the community surrounding each project. KeePass 2 seems to still be hosted on Sourceforge, and I'm not even sure where to get a copy of the latest (non-release) version of the source. The [Sourceforge repo][1] seems to be an outdated SVN repo which was last updated in 2009, and I don't see any description of how to contribute code to the project anywhere. As a result I'm not really sure how to gauge the level of activity on the project itself. Similarly, the website is ancient and doesn't seem to have kept up with the times; I seem to recall it was only recently that it even got HTTPS support. In contrast, KeePassXC is hosted on GitHub, development is done out in the open, and it's trivial to see that in just the last year there were [dozens of individual contributors][2]. The website looks clean, is user-friendly with up-to-date documentation, and a [contribution guide][3] is plainly visible in the README on GitHub. As a result, I feel a bit better about the long-term prospects of KeePassXC over KeePass 2. [1]: https://sourceforge.net/p/keepass/code/HEAD/tree/ https://sourceforge.net/p/keepass/code/HEAD/tree/ [2]: https://github.com/keepassxreboot/keepassxc/graphs/contributors?from=2017-02-26&to=2018-02-28&type=c https://github.com/keepassxreboot/keepassxc/graphs/contribut... [3]: https://github.com/keepassxreboot/keepassxc#contributing https://github.com/keepassxreboot/keepassxc#contributing

minimaxir 9y ago

Previous thread about KeepPassXC 2.2.0: https://news.ycombinator.com/item?id=14633576 https://news.ycombinator.com/item?id=14633576 I used KeePassXC for a period, but from these release notes, the UI/UX still isn't great. If you're on macOS, I recommend MacPass, which feels more native to the system, is compatible with existing KBDX databases and most-importantly, is also open-source: https://github.com/MacPass/MacPass https://github.com/MacPass/MacPass

tripzilch 9y ago
I was a little confused by your comment at first, maybe you didn't intend it that way, but I got the impression that you meant MacPass is open source, unlike KeePassXC. Except that KeepassXC is in fact open source: https://github.com/keepassxreboot/keepassxc/ https://github.com/keepassxreboot/keepassxc/ I suppose you meant that MacPass is open source, unlike some other Mac password managers? I didn't really check until someone downthreads mentioned that KeePassXC is (basically) a superset of KeePassX, which I know is open source because I use it as my password manager. So that means it's time for me to check out KeePassXC :) See what it does for me :)
vetinari 9y ago
I just switched from MacPass to KeePassXC for the reason mentioned in release notes: it obsoletes the HTTP Connector and uses another mechanism. MacPass keeps using HTTP, and it is uknown, when it will do the same switch. Given that I use multiple computers, and the extensions are synced, I want to use the same mechanism on all of them.
- scrollaway 9y ago
  Do you know the details of the differences between the old and the new mechanisms? All I see is a migration is required, but I used neither.
  - vetinari 9y ago
    The new mechanism uses Native Messaging[0], with the native application being keepassxc-proxy. The old one used HTTP, with the server (the password manager) listening on localhost. [0] https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Native_messaging https://developer.mozilla.org/en-US/Add-ons/WebExtensions/Na...

piracykills 9y ago

> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome. Congrats on the release.

guessmyname 9y ago
Last week I started reverse engineering the KDBX 3.1 file format (for fun). Does anyone knows where is the specification for KDBX 4.0? EDIT: Found it — https://github.com/keepassxreboot/keepassxc-specs https://github.com/keepassxreboot/keepassxc-specs
- danesparza 9y ago
  This link also talks about changes to the spec for 4.x (but in more general terms): https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html
- agildehaus 9y ago
  I don't believe the XML format has changed at all. Just the key derivation, stream cipher, and some changes to the binary header.
  - hacking_nomad 9y ago
    The XML Format has changed. Entries and Groups now support custom data. This was only supported on the database in KDBX3.1. Also, the settings now have a modified date which makes synchronising them when merging databases a lot easier. The other changes are done to the binary format as you say. Also to make the file smaller, attachments are now stored compressed "as is" instead of encoding them in base64 and adding them to the XML structure.
minimaxir 9y ago
What are the advantages/disadvantages of using Argon2/ChaCha20 over the current AES implementation? What are good parameters for those algos?

m-p-3 9y ago

The Chrome Web Store link seems to 404. https://chrome.google.com/webstore/detail/keepassxc-browser/iopaggbpplllidnfmcghoonnokmjoicf https://chrome.google.com/webstore/detail/keepassxc-browser/...

m-p-3 9y ago
Looks like the link in the github repo isn't up to date, here's another one I've found https://chrome.google.com/webstore/detail/keepassxc-browser/oboonakemofpalcgghocfoadofidjkkk https://chrome.google.com/webstore/detail/keepassxc-browser/...
deleted 9y ago
[deleted]

therealmarv 9y ago

is it stable again? Last version was constantly crashing when modifying a new passwort entry again. This is something which is unacceptable for a password manager IMHO.

mdaniel 9y ago
Did you file an issue over that behavior?
- therealmarv 9y ago
  the bug is still there. 2.3 can still crash after creating a new entry and reedit the password. I will try to reproduce the error with a new kdbx and report the bug.

076ae80a-3c97-4 9y ago

I highly recommend https://keeweb.info/ https://keeweb.info/ if you're looking for an attractive, easy to use, cross-platform and Open Source solution. I've been using it on Windows and MacOS for years without any major issues. It's by far the best looking front-end for keepass databases I've seen.

agildehaus 9y ago
Unfortunately it's slow as hell. KDBX4 file, ChaCha20/Argon2 30 rounds, that takes under a second to open in KeePassXC took 10 seconds in this app. Electron apps ...
kayman 9y ago
+1 for keeweb. It's central to my password management strategy now. Can't recommend it enough. I've tried the offline versions, but I find myself often on the go - without my laptop. The tools for mobile don't seem to support updates - read only. Keeweb does both.
franga2000 9y ago
I love KeeWeb, especially when used together with Nextcloud. I can access my passwords in a buch of different ways, all synced and all secure (the kdbx has a password and a file key). 1. In KeeWeb from inside Nextcloud (there's an app) 2. In external KeeWeb over WebDAV (great when using it as a PWA) 3. In KeePass proper using desktop file sync 4. In a KeePass-compatible app from the Nextcloud app All of these sound janky, but they work better that any other free software self-hosted cloud password manager.

TorKlingberg 9y ago

I currently use KeePass2 + Dropbox + Kee (Firefox) + MiniKeePass (iOS). Can KeePassXC + plugins replace those, and what are the advantages?

nwah1 9y ago
The announcement mentioned that they just released a new Firefox addon called KeepassXC-Browser. KeepassXC doesn't work on iOS. It is just a replacement for KeePass2
StavrosK 9y ago
KeePassXC can read KeePass2, so it only needs to replace that. That said, I haven't found a Kee replacement I like, so I'm still on KeePass2 (and it's fine for my needs).

JamesCoyne 9y ago

Anybody have thoughts about where to store the encrypted database for backup? Would it be foolish to keep the database somewhere publicly accessible?

scrollaway 9y ago
It's not ideal for your encrypted db to leak because, should you mistakenly leak your master password (which can happen simply through a keylogger for example), all the contents are now at risk. However, something like Google Drive is fine. Trust Google engineers to secure your data. Dropbox also fine if you don't like Google.
- JamesCoyne 9y ago
  This makes sense. Presently my database lives on dropbox and is not in view of the public.
avuton 9y ago
I store mine on a personal NextCloud with davfs, but any secure online storage should do.
nas 9y ago
I store the .kdbx (database) file on a network synced folder (e.g. like dropbox or gdrive). However, I use a "key file" in addition to a password. The key file is not synced and remains on computers that I control. I also have a backup copy on external media.
- fauigerzigerk 9y ago
  Aren't you worried about that fact that any program you run could potentially read all your passwords using the key file?
  - Macha 9y ago
    You can have a composite password to unlock consisting of keyfile + passphrase.

scrollaway 9y ago

Since it got a lot of positive attention last time, here's a rough guide on getting started with password management, aimed at readers here who are not currently using a password manager: https://leclan.ch/password-managers/ https://leclan.ch/password-managers/ TLDR: Download KeepassXC and start using it. :)

zouhair 9y ago
What does it do that Keepass/KeepassX cannot do? I looked at their website and nothing new shows up.
- scrollaway 9y ago
  I address that at the bottom of my post. Keepass is the original, KeepassX is the Qt rewrite. KeepassXC got Qt 5 support, a bunch of misc QOL improvement patches, is actively maintained (unlike KeepassX) and also received some nice extra features such as TOTP 2FA support. It's a superset of KeepassX, so there's no real reason to use KeepassX at this point.

bdz 9y ago

Is it worth moving to this from 1Password? I mean I don't have any problems at all tho I use an old version (6 on Mac, 4 on Win), the permanent license version not this new subscription. I was thinking to use this with Dropbox, Chrome, and iOS client (MiniKeePass?)

xylia 9y ago
I suggest using Bitwarden (open source) instead. See my article: https://greycoder.com/bitwarden-excellent-free-password-manager/ https://greycoder.com/bitwarden-excellent-free-password-mana...
- drdaeman 9y ago
  The linked article is very light on details to be called a comparison. Let me try to make it a little bit more detailed. ==================== Bitwarden: - Is essentially a service (with FLOSS client software and FLOSS server code). - Quite polished browser integration (to the extent browsers allow it). - Third party server holding the encrypted data. Proprietary (in a "completely unique, not compatible with anything else" sense) sync protocol. - Symmetric encryption key is encrypted with master key but it is NOT changed (with re-encrypting all the entries) when master password is changed. I'm not sure if there is an option to re-encrypt the data in case the symmetric key is compromised, although this should be doable via APIs. - Data is encrypted and signed, but some of the data structure (folder layout, TOTP existence, revision dates) is (theoretically) accessible to the service owners. Check out snippets at https://github.com/jcs/bitwarden-ruby/blob/master/API.md https://github.com/jcs/bitwarden-ruby/blob/master/API.md for info. - Has some nice extras built-in, like domain equivalence logic. - Self-hosted option is available (official Docker images using .NET Core and Microsoft SQL Server and unofficial third-party implementation in Ruby). I'm not sure how this works with licensing. ==================== Keepass: - Is primarily a standalone application. Or, better say, applications, as there are multiple independent implementations for many platforms. - Has browser integration, but all options (KeepassXC-Browser and PassIFox) are feel somewhat less polished. - Has composite credentials (in addition or instead of master password it can use i.e. keyfiles). Supported mechanisms vary with implementation. - If the encryption keys are compromised you can trivially re-encrypt the database to avoid further leaks. - File format is essentially a large encrypted and signed XML file (data block) with some extensible header that defines the crypto details. https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html - You handle the sync however you want it. For KeepassXC you need make database available in a filesystem. For Keepass and Android app there are also SFTP, WebDAV, Dropbox, Google Drive and some other options available. The only sync that's in the app is a logic for merging databases. ==================== Please correct me if I got something wrong. Thanks.

SCdF 9y ago

Does anyone know of an iOS client that supports Argon2? The amazing Keepass2Android already supports it, but I can't move to it until there is also an iOS solution…

dlandis 9y ago

Does anyone know what the license is for this software? It looks like there are NINE different license files in the repo: https://github.com/keepassxreboot/keepassxc https://github.com/keepassxreboot/keepassxc Did they just copy paste every different license they could find into the repo?

Jeaye 9y ago
https://keepassxc.org/ https://keepassxc.org/ > The full source code is published under the terms of the GNU General Public License. We see open source as a vital prerequisite for any security-critical software product. For that reason, KeePassXC is and always will be free as in freedom (and in beer). Contributions by everyone are welcome!
pfg 9y ago
Not all parts of the source code are available under the same license. The individual source code files include the applicable license. Doing this is fine for compatible licenses and not unusual for projects, though it can make certain things more complicated. Here's an example of what GNU says about GPL compatibility[1] - roughly meaning the whole work is published as GPL. [1]: https://www.gnu.org/licenses/gpl-faq.html#WhatDoesCompatMean https://www.gnu.org/licenses/gpl-faq.html#WhatDoesCompatMean
deleted 9y ago
[deleted]
th3zero 9y ago
KeePassXC maintainer here. This comment is really funny and made me laugh. Anyway we are following the Debian guidelines. The full copyright for each component and file is specified in the COPYING file in the root of the repository along side with each author.

awill 9y ago

I was a longtime user of KeePassX. The UI was terrible, but it was free, open source and most importantly cross platform. After KeePass2 made the DB incompatible and rewrote everything in C# it stopped being a proper cross platform product and I investigated aternatices. I've since moved to enpass and I'm very happy. Enpass is a great, native app on Win/Mac/Linux and has native Android/iOS apps (with fingerprint support etc..). Great UI, no subscription fees, no cloud hosting (though it syncs to your personal dropbox, gDrive, OwnCLoud etc..). I couldn't ask for more.

tmikaeld 9y ago
Only problem with it as i see it, it's closed source. I switched to Bitwarden for that reason alone. With that said, Bitwarden has it's issues: https://github.com/bitwarden/browser/issues/77 https://github.com/bitwarden/browser/issues/77
satish-setty 9y ago
> I was a longtime user of KeePassX. Probably you mean KeePass (the "original" one), which is written in C# and requires Mono in Linux ? KeepassX has always been native C++ and cross-platform.

shmerl 9y ago

Great replacement for keepassx which got stuck with Qt 4 forever.

ff_ 9y ago

The best UX improvement in this release (IMHO) is pretty buried in the changelog, and I don't see it mentioned here: no more lock files! If you use Keepass on something like Dropbox it's a blessing.

softawre 9y ago
Nice! This was one of two or three reasons I bit the bullet and switched to 1password yearly.
TacticalMalice 9y ago
The mentioned issue has the following statement which makes me wonder whether concurrent use on sync services is supported atm: > I was going to add tests for "concurrent" access of the same file in phase 2 of these changes. Phase 2 is refactoring the saving process entirely to make it asynchronous and robust to file sync services.
- zaarn 9y ago
  From my experience, it already works somewhat. Atleast, whenever I overwrote the file in Nextcloud and my desktop pulled the update, it would merge the changes automatically.

nmy 9y ago

Remove lock file [#1231] is a good one for the ones who sync their KPXC databases between devices

znpy 9y ago

Serious question: why should I leave KeePassX ?

sigzero 9y ago
Q: Why KeePassXC instead of KeePassX? A: KeePassX is an amazing password manager, but hasn't seen much active development for quite a while. Many good pull requests were never merged and the original project is missing some features which users can expect from a modern password manager. Hence, we decided to fork KeePassX to continue its development and provide you with everything you love about KeePassX plus many new features and bugfixes.
Sylos 9y ago
It's in my opinion just a straight upgrade from KeePassX. Not a significant upgrade, but switching is probably not going to require significant effort either.

diimdeep 9y ago

UI/UX is terrible, I suggest try MacPass or KeeWeb

eikenberry 9y ago

I always find it interesting to see which of the new distro agnostic packages these applications provide. In this case AppImage and Snap. It really looks like AppImage is taking the lead among these new packaging technologies. When the project does provide these sorts of packages you always see AppImages, but rarely see Snap or Flatpak based images.

teilo 9y ago

The thing that keeps me in 1Password is its Team Vault support. Nothing works quite so well for maintaining a shared password vault. If I didn't need that, I'd drop 1Password for KeePass in a heartbeat.

wheresvic1 9y ago
Why not just make a keypass db for your shared passwords, put it on dropbox and share it with your team? Or put it in git even, if you want better traceability.

sapphire_tomb 9y ago

I really wanted to switch to using KeePassXC instead of the original one, as it's definitely a better user experience for the most part when you're flipping between OSes (Windows 10 and various Linux distros in my case). But my workflow requires I keep my kdbx in a git repo in order to sync between work and home, and I cannot get used to the missing "Synchronise with File" feature, which the original Keepass has, but KeePassXC omits.

cryptos 9y ago

I'd prefer if a password would be generated by default, when you create a new entry. That's the way KeePass works and it encourages to use strong generated passwords (instead of user created passwords). Another thing I'd like to have is a details view for each key in the list view (https://keepassxc.org/images/screenshots/linux/screen_002.png https://keepassxc.org/images/screenshots/linux/screen_002.pn...). Something like the bottom panel here: https://keepass.info/screenshots/keepass_2x/main_big.png https://keepass.info/screenshots/keepass_2x/main_big.png (but please more beautiful). I have a scenario where I need an additional authentifiction factor besides that password that I store in KeePassXC, too.

varjolintu 9y ago
Actually, there is a details view. Check the settings if it's disabled.

kertis 9y ago

Actually it's cool that it was forked. But qt5 apps have pretty bad fonts view on my xfce desktop especially with black themes like Ark dark. That's why I am on KeepassX so far.