13 ms·

Lockbox – A stand-alone password manager that works with Firefox for desktop

190 points by doppp 9y ago

pmulv 9y ago
I didn't know what Mozilla Lockbox was, but I found this[0] which might help others. [0] - https://mozilla-lockbox.github.io/lockbox-extension/ https://mozilla-lockbox.github.io/lockbox-extension/
fwdpropaganda 9y ago
Remember kids, don't trust anyone with your passwords, not even Mozilla. That said, I enjoyed having a look at Mozilla's internal project management tool for this extension, https://waffle.io/mozilla-lockbox/lockbox-extension https://waffle.io/mozilla-lockbox/lockbox-extension I wish I could have the same kind of look into other company's projects.
- blowski 9y ago
  “Don’t trust anyone” is a bit strong, and probably counterproductive. Be careful whom you trust is better.
  - dwighttk 9y ago
    don't trust anyone: even the people with whom you are attempting to verify your identity using a password.
  - ealhad 9y ago
    Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done with the code sent by a server.
    - blowski 9y ago
      Can you trust the client side encryption?
    - ams6110 9y ago
      Who is providing the encryption? If it's the same third party, there is a trust needed there.
    - bonyt 9y ago
      You've still got to trust the software doing the encryption, and the other software on your machine that might be able to interact with the software doing the encryption (e.g., browser and other browser add-ons, particularly when using a browser-based client side encryption scheme).
      - Xylakant 9y ago
        In this case, the software is open source, so the software can be evaluated.
        zeveb 9y ago
        > In this case, the software is open source, so the software can be evaluated. You enter your password on a page Mozilla serve[0]; they can change the source of that page at any time, and for a single user. They could for example, send your password in the clear back to their servers if they wished. 0: https://www.mozilla.org/en-US/firefox/accounts/ https://www.mozilla.org/en-US/firefox/accounts/
        Xylakant 9y ago
        All of this seems to be very alpha, but it's described as a standalone password manager and as far as I skimmed the docs, the firefox account doesn't necessarily seem to be a requirement. It might be something the extension requires, though.
        zeveb 9y ago
        Ah, good point — I was thinking of the issues with Firefox Sync.
      - blowski 9y ago
        And the hardware - the keyboard, the processor, etc. And the environment - your colleagues, any cameras. In the end, you have to give some trust to some people.
    - zeveb 9y ago
      Mozilla's client-side encryption uses a key which is itself encrypted with your Firefox Account password — and Mozilla serve you the JavaScript used to log into your account, so they can steal your password whenever you log in using your web browser. There old password-storage system really was secure, but they end-of-lifed it.
- daveFNbuck 9y ago
  If you're using their browser, you're already trusting them with the password for every website you log in to.
  - fwdpropaganda 9y ago
    Technically, yes, you're right. But in practice, the higher the visibility of the code you're relying on, the more likely it is that other people have caught something fishy. And POST is higher visibility than lockbox. This is also the reason why even though I trust Mozilla very much, I don't use Sync. It's lower visibility than the vanilla stuff. Also, attack surface.
    - daveFNbuck 9y ago
      That's a much more nuanced point than "don't trust anyone with your passwords." I agree with your reasoning, but that doesn't mean you shouldn't ever trust a password manager. It just means that you should have a high standard for when you should trust one. Not having a password manager opens up attack surfaces as well. Having a password manager integrated into my browser has prevented me from typing my password into a lookalike site from a different domain. It also means I don't use the same password for any two sites, and the password I use for each site is much stronger than it would otherwise be. There's the potential for the password manager to get compromised, but the benefits seem to outweigh that for now.
toyg 9y ago
Seems a bit late to get in the password-manager business, where you have plenty of incumbents (1Password, LastPass, Bitwarden, KeePass...) offering a plethora of features. The Mozilla audience likely overlaps most of the target demographic for such products already, and persuading people to switch will be very hard. It could make sense if Mozilla were to develop a standard interface for all password managers, so I could swap implementations under the hood without having to deal with their (occasionally half-baked) extensions. But I guess this is just a Big Rewrite of the venerable utility we've been using since the dawn of Moz.
- codetrotter 9y ago
  Not necessarily. I’ve been a LastPass user in the past but quit after some event I can’t even remember I just remember I am not going back. Lockbox being open source and integrating nicely with Firefox and Firefox Accounts makes me want to use it. I am the target audience of Lockbox. One day I will run my own Firefox Accounts server. For now I use the one that Mozilla is running. https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html https://mozilla-services.readthedocs.io/en/latest/howtos/run...
  - tEMporality7 9y ago
    > I’ve been a LastPass user in the past but quit after some event I can’t even remember The 2015 security breach?
    - codetrotter 9y ago
      Yeah probably
- pibefision 9y ago
  When dropbox launched, we already had a lot of filesync options. It is not too late to add value in the password management business and Mozilla is trusted.
  - 9y ago
binaryanomaly 9y ago
Very pleasant and refreshing to see some activity on the OSS front here. I believe Mozilla would have the resources to bring this to a success. Although naivety aside - I think it'll take years to only slightly catch up with the comfort and usability 1Password already provides. While it's not OSS it is still the benchmark to beat in terms of usability and integration. Good luck Mozilla!
- remir 9y ago
  Bitwarden is open source and IMO a very good alternative to LastPass and 1password.
  - binaryanomaly 9y ago
    The client did not convince me compared to 1Password. And then you either use their cloud or need to host a .net container yourself - which was a no go for me. Then I can also stay with 1PW. But a matter of taste of course in the end...
    - durin42 9y ago
      You might find https://github.com/jcs/bitwarden-ruby https://github.com/jcs/bitwarden-ruby an interesting hosting alternative, FWIW.
    - e12e 9y ago
      Fwiw, because of bitwarden's openness, there's also: https://github.com/jcs/bitwarden-ruby https://github.com/jcs/bitwarden-ruby
    - zie 9y ago
      There is the ruby version, that others mentioned and there is also the go implementation: https://github.com/VictorNine/bitwarden-go https://github.com/VictorNine/bitwarden-go
- bhhaskin 9y ago
  Pass[0] is pretty great. GPG encrypted and synced with Git. There is a great cross browser extension called browserpass[1]. I have mine tied to my yubikey, so it needs a physical device to decrypted my passwords. [0] https://www.passwordstore.org/ https://www.passwordstore.org/ [1] https://github.com/dannyvankooten/browserpass#readme https://github.com/dannyvankooten/browserpass#readme
tmd83 9y ago
I saw this couple of days ago with Mozilla roadmap. But I have been wondering about few things. 1. Why firefox only? 2. Why encryption is limited to Firefox account. Such lock-in with firefox doesn't make sense to me with Mozilla's vision. If it's due to this being an experiment still that would make sense but that should be made clear I think.
- zaarn 9y ago
  On the website it's explicitly stated to be a test without disturbing people using "Saved Logins". I suspect Lockbox will replace those in the future...
  - tmd83 9y ago
    Hmm I read that. And I was wondering if that meant in future that open it up. Now I'm wondering if this is essentially doing the coding outside core firefox project with the later plan to just integrate it fully into the browser. Almost like an experimental build kind of workflow. I guess that kinda make sense.
- sametmax 9y ago
  Making it a standard requires a lot of work. Not doing so gives firefox an edge against other browsers. So if you are resource constrain, testing a product, and an underdog again, I understand the idea. But my guess is they will make it more generic and open later, mozilla being mozilla.
- rookwood102 9y ago
  Why doesn't mozilla use the KeePass KDBX (4?)[0] format to store the passwords? KeePass is already in use by many including myself and is compatible with a massive ecosystem of software (lots of clients on different platforms [1]). The only problem they might have is that they want to use the password from one's Firefox account to encrypt the DB, although surely that integration could be worked out somehow? What would be the downsides of this approach? [0]: https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html [1]: https://keepass.info/download.html https://keepass.info/download.html
floatingatoll 9y ago
Please take note of the “experimental” label on this open source repository, which is posted to HN every few weeks. Previously: https://news.ycombinator.com/item?id=15992762 https://news.ycombinator.com/item?id=15992762 https://news.ycombinator.com/item?id=15997239 https://news.ycombinator.com/item?id=15997239 https://news.ycombinator.com/item?id=15832879 https://news.ycombinator.com/item?id=15832879 https://news.ycombinator.com/item?id=15596740 https://news.ycombinator.com/item?id=15596740
ealhad 9y ago
I use KeePassXC [1] with Syncthing [2] to synchronize my passwords between machines. [1] : https://keepassxc.org/ https://keepassxc.org/ [2] : https://syncthing.net/ https://syncthing.net/
- maccard 9y ago
  I use a similar combo (keepssX+keepass touch with Dropbox to sync), and frankly it’s a pain. There is no support at all in KeepassX for Dropbox or other sync methods, and they’re not interested in providing it either, stating that a few triggers to auto synchronise is a viable solution. Until an open source project takes multi device seriously, they don’t get mainstream adoption.
  - Digit-Al 9y ago
    Have a look at Password Safe. It has an Android version as well as a Windows version (and Linux I think). The Android version has PasswordSafe Synch, which allows it to automatically synchronise your password vault when hosted on a variety of online storage solutions including Dropbox and Google Drive. Plus the Android version has a custom keyboard for entering user name, password, etc... without having to copy/paste.
  - slavik81 9y ago
    I don't understand what "Dropbox support" is. Dropbox will sync any file.
    - jhasse 9y ago
      I'd guess merge support in case of conflict and web GUI access.
      - maccard 9y ago
        No, keepass’s recommended approach is a total PITA to set up, and completely non-intuitive [0]. [0] https://keepass.info/help/kb/trigger_examples.html#dbsync https://keepass.info/help/kb/trigger_examples.html#dbsync
lawl 9y ago
This site doesn't answer the question 'why'. Keepass usage seems pretty widespread. Okay Keepass doesn't integrate too well into browsers. But then why not just fix Keepass? There have been way too many products pushed out failed utterly and abandoned by mozilla in the last few years. Why should I care about this one, if it doesn't even tell me what it wants to do better than other products. The text on the website reads like this is simply a POC for a new built-in password manager in firefox, is that correct? But then why standalone?
- 0xTJ 9y ago
  I've been using KeeFox (now Kee) and I like it. It's not perfect, but it works well with KeePass. That, along with Dropbox syncing, and the app Keepass2Android make it my preferred method for password management.
- laurent123456 9y ago
  Keepass does not provide anything to sync passwords between devices which seems to be an important part of Lockbox.
  - hanbura 9y ago
    If anything, I would have said that KeePass provides too many ways to sync devices... KeePass has a feature to sync two files, and can access a variety of network storages. That's not one turn-key solution, but it covers just about everything. Meanwhile I simply store the file in my Dropbox because I don't do concurrent edits and it's slightly more convenient that way
    - hanklazard 9y ago
      Agreed. Dropbox + KeepassXC has been a great combo for me.
      - mariusmg 9y ago
        >Dropbox Honest question, but pushing your KeepassXC db into Dropbox shouldn't raise some red flags from a security perspective ? If "somebody" gets your encrypted db, they can rainbowtable the crap out of it to unlock it. To me it seems by using Dropbox you just add another sizeable attack surface.
raimue 9y ago
This looks interesting to finally replace the outdated Firefox password manager. It is especially important as it was recently shown that the protection by the "master password" does not meet modern security standards. But what exactly is "stand-alone" supposed to mean in this context? At the moment it is distributed as a Firefox extension that replaces the Firefox password manager. This seems like the opposite of "stand-alone" to me, as you cannot use it without Firefox.
willart4food 9y ago
Narcissists and sociopaths dismiss someone's success with "You were lucky". The appropriate response in those cases is: FU.
Flimm 9y ago
Does this offer any password-sharing features? Can you share some passwords with other Mozilla/Firefox accounts?
- cpeterso 9y ago
  Not yet. Lockbox's stored passwords will be integrated with Firefox Accounts sync before it is released.
alexghr 9y ago
Installed it from the website, logged-in with my Firefox account and got redirected to allizom.org ("Mozilla" spelled backwards!) which has an untrusted certificate. Not a great first experience :(
- cpeterso 9y ago
  What Firefox version are you running? This sounds like Firefox bug 1411646, which should have been fixed in Firefox 58: https://bugzilla.mozilla.org/show_bug.cgi?id=1411646 https://bugzilla.mozilla.org/show_bug.cgi?id=1411646
  - alexghr 9y ago
    I'm on 59.0.1 (64-bit) for Ubuntu Artful (from the official repos). This is quite an odd bug, thanks for the link (and the link from the sibling comment). I'll keep an eye on the bug reports :)
- devinreams 9y ago
  Hmmm, it may also be a symptom of something similar we've seen intermittently here: https://bugzilla.mozilla.org/show_bug.cgi?id=1424397 https://bugzilla.mozilla.org/show_bug.cgi?id=1424397
KirinDave 9y ago
So... Did this initiative appear because it came out that Firefox was using an ancient and astoundingly insecure practice for its prior password storage product? Given Firefox was only 2 years ago so insecure it wasn't even a valid target for most browser pwn competitions, and just in this year we find out important code is still held over from those days, I'm not sure why anyone should trust Firefox.
- cpeterso 9y ago
  This is not a brand new project. The first Lockbox alpha release was back in September 2017: https://github.com/mozilla-lockbox/lockbox-extension/releases?after=0.1.1-alpha1 https://github.com/mozilla-lockbox/lockbox-extension/release...
- deleted 9y ago
  [deleted]
cajdavidson 9y ago
I've recently moved from Lastpass to using Pass[0] & BrowserPass[1], just as convenient and allows me to manage the storing of passwords myself. All files are PGP encrypted. Storing my passwords in my self hosted GIT allows them to be checked out on to my tablet and phone for convenience as well. [0] https://www.passwordstore.org/ https://www.passwordstore.org/ [1] https://github.com/dannyvankooten/browserpass https://github.com/dannyvankooten/browserpass
- syx 9y ago
  Same here, pass does its job and works like a charm. I haven't tried BrowserPass yet, but it's something I'll definitely look into.
- freedomben 9y ago
  Did you move away from Lastpass for any reasons other than self-storage/management of passwords? Anecdotally it seems like a lot of people are losing trust in Lastpass. Just curious if this describes you as well.
  - craftyguy 9y ago
    not gp, but I did the same thing a few years back (well, lastpass->keepass->pass/git) primarily because I was sick of using a proprietary walled garden. The main benefit of pass, for me, is that it's literally just gpg-encrypted text files. I can access my passwords even if I do not have pass installed, as long as I have my gpg private key. Using git to sync passwords makes it even better! The android Password Store app (on f-droid) is a great graphical interface to my pass files, including handling git syncs.
    - cajdavidson 9y ago
      +1 for the Password Store app, I happen to use an Android tablet and an iPhone and the "Pass" app on iPhone works just as well too (and includes touchID).
    - 0xfeba 9y ago
conradev 9y ago
> The Lockbox extension is a simple, stand-alone password manager that works with Firefox for desktop So it's stand-alone, but I need Firefox to use it?
- 333c 9y ago
  I think they mean that it isn't baked in to Firefox. But I agree that that's a weird choice of wording.

190 points by doppp 9y ago

I didn't know what Mozilla Lockbox was, but I found this[0] which might help others. [0] - https://mozilla-lockbox.github.io/lockbox-extension/ https://mozilla-lockbox.github.io/lockbox-extension/

fwdpropaganda 9y ago

Remember kids, don't trust anyone with your passwords, not even Mozilla. That said, I enjoyed having a look at Mozilla's internal project management tool for this extension, https://waffle.io/mozilla-lockbox/lockbox-extension https://waffle.io/mozilla-lockbox/lockbox-extension I wish I could have the same kind of look into other company's projects.

blowski 9y ago
“Don’t trust anyone” is a bit strong, and probably counterproductive. Be careful whom you trust is better.
- dwighttk 9y ago
  don't trust anyone: even the people with whom you are attempting to verify your identity using a password.
- ealhad 9y ago
  Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done with the code sent by a server.
  - blowski 9y ago
    Can you trust the client side encryption?
  - ams6110 9y ago
    Who is providing the encryption? If it's the same third party, there is a trust needed there.
  - bonyt 9y ago
    You've still got to trust the software doing the encryption, and the other software on your machine that might be able to interact with the software doing the encryption (e.g., browser and other browser add-ons, particularly when using a browser-based client side encryption scheme).
    - Xylakant 9y ago
      In this case, the software is open source, so the software can be evaluated.
      - zeveb 9y ago
        > In this case, the software is open source, so the software can be evaluated. You enter your password on a page Mozilla serve[0]; they can change the source of that page at any time, and for a single user. They could for example, send your password in the clear back to their servers if they wished. 0: https://www.mozilla.org/en-US/firefox/accounts/ https://www.mozilla.org/en-US/firefox/accounts/
        Xylakant 9y ago
        All of this seems to be very alpha, but it's described as a standalone password manager and as far as I skimmed the docs, the firefox account doesn't necessarily seem to be a requirement. It might be something the extension requires, though.
        zeveb 9y ago
        Ah, good point — I was thinking of the issues with Firefox Sync.
    - blowski 9y ago
      And the hardware - the keyboard, the processor, etc. And the environment - your colleagues, any cameras. In the end, you have to give some trust to some people.
  - zeveb 9y ago
    Mozilla's client-side encryption uses a key which is itself encrypted with your Firefox Account password — and Mozilla serve you the JavaScript used to log into your account, so they can steal your password whenever you log in using your web browser. There old password-storage system really was secure, but they end-of-lifed it.
daveFNbuck 9y ago
If you're using their browser, you're already trusting them with the password for every website you log in to.
- fwdpropaganda 9y ago
  Technically, yes, you're right. But in practice, the higher the visibility of the code you're relying on, the more likely it is that other people have caught something fishy. And POST is higher visibility than lockbox. This is also the reason why even though I trust Mozilla very much, I don't use Sync. It's lower visibility than the vanilla stuff. Also, attack surface.
  - daveFNbuck 9y ago
    That's a much more nuanced point than "don't trust anyone with your passwords." I agree with your reasoning, but that doesn't mean you shouldn't ever trust a password manager. It just means that you should have a high standard for when you should trust one. Not having a password manager opens up attack surfaces as well. Having a password manager integrated into my browser has prevented me from typing my password into a lookalike site from a different domain. It also means I don't use the same password for any two sites, and the password I use for each site is much stronger than it would otherwise be. There's the potential for the password manager to get compromised, but the benefits seem to outweigh that for now.

toyg 9y ago

Seems a bit late to get in the password-manager business, where you have plenty of incumbents (1Password, LastPass, Bitwarden, KeePass...) offering a plethora of features. The Mozilla audience likely overlaps most of the target demographic for such products already, and persuading people to switch will be very hard. It could make sense if Mozilla were to develop a standard interface for all password managers, so I could swap implementations under the hood without having to deal with their (occasionally half-baked) extensions. But I guess this is just a Big Rewrite of the venerable utility we've been using since the dawn of Moz.

codetrotter 9y ago
Not necessarily. I’ve been a LastPass user in the past but quit after some event I can’t even remember I just remember I am not going back. Lockbox being open source and integrating nicely with Firefox and Firefox Accounts makes me want to use it. I am the target audience of Lockbox. One day I will run my own Firefox Accounts server. For now I use the one that Mozilla is running. https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html https://mozilla-services.readthedocs.io/en/latest/howtos/run...
- tEMporality7 9y ago
  > I’ve been a LastPass user in the past but quit after some event I can’t even remember The 2015 security breach?
  - codetrotter 9y ago
    Yeah probably
pibefision 9y ago
When dropbox launched, we already had a lot of filesync options. It is not too late to add value in the password management business and Mozilla is trusted.
- 9y ago

binaryanomaly 9y ago

Very pleasant and refreshing to see some activity on the OSS front here. I believe Mozilla would have the resources to bring this to a success. Although naivety aside - I think it'll take years to only slightly catch up with the comfort and usability 1Password already provides. While it's not OSS it is still the benchmark to beat in terms of usability and integration. Good luck Mozilla!

remir 9y ago
Bitwarden is open source and IMO a very good alternative to LastPass and 1password.
- binaryanomaly 9y ago
  The client did not convince me compared to 1Password. And then you either use their cloud or need to host a .net container yourself - which was a no go for me. Then I can also stay with 1PW. But a matter of taste of course in the end...
  - durin42 9y ago
    You might find https://github.com/jcs/bitwarden-ruby https://github.com/jcs/bitwarden-ruby an interesting hosting alternative, FWIW.
  - e12e 9y ago
    Fwiw, because of bitwarden's openness, there's also: https://github.com/jcs/bitwarden-ruby https://github.com/jcs/bitwarden-ruby
  - zie 9y ago
    There is the ruby version, that others mentioned and there is also the go implementation: https://github.com/VictorNine/bitwarden-go https://github.com/VictorNine/bitwarden-go
bhhaskin 9y ago
Pass[0] is pretty great. GPG encrypted and synced with Git. There is a great cross browser extension called browserpass[1]. I have mine tied to my yubikey, so it needs a physical device to decrypted my passwords. [0] https://www.passwordstore.org/ https://www.passwordstore.org/ [1] https://github.com/dannyvankooten/browserpass#readme https://github.com/dannyvankooten/browserpass#readme

tmd83 9y ago

I saw this couple of days ago with Mozilla roadmap. But I have been wondering about few things. 1. Why firefox only? 2. Why encryption is limited to Firefox account. Such lock-in with firefox doesn't make sense to me with Mozilla's vision. If it's due to this being an experiment still that would make sense but that should be made clear I think.

zaarn 9y ago
On the website it's explicitly stated to be a test without disturbing people using "Saved Logins". I suspect Lockbox will replace those in the future...
- tmd83 9y ago
  Hmm I read that. And I was wondering if that meant in future that open it up. Now I'm wondering if this is essentially doing the coding outside core firefox project with the later plan to just integrate it fully into the browser. Almost like an experimental build kind of workflow. I guess that kinda make sense.
sametmax 9y ago
Making it a standard requires a lot of work. Not doing so gives firefox an edge against other browsers. So if you are resource constrain, testing a product, and an underdog again, I understand the idea. But my guess is they will make it more generic and open later, mozilla being mozilla.
rookwood102 9y ago
Why doesn't mozilla use the KeePass KDBX (4?)[0] format to store the passwords? KeePass is already in use by many including myself and is compatible with a massive ecosystem of software (lots of clients on different platforms [1]). The only problem they might have is that they want to use the password from one's Firefox account to encrypt the DB, although surely that integration could be worked out somehow? What would be the downsides of this approach? [0]: https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html [1]: https://keepass.info/download.html https://keepass.info/download.html

floatingatoll 9y ago

Please take note of the “experimental” label on this open source repository, which is posted to HN every few weeks. Previously: https://news.ycombinator.com/item?id=15992762 https://news.ycombinator.com/item?id=15992762 https://news.ycombinator.com/item?id=15997239 https://news.ycombinator.com/item?id=15997239 https://news.ycombinator.com/item?id=15832879 https://news.ycombinator.com/item?id=15832879 https://news.ycombinator.com/item?id=15596740 https://news.ycombinator.com/item?id=15596740

ealhad 9y ago

I use KeePassXC [1] with Syncthing [2] to synchronize my passwords between machines. [1] : https://keepassxc.org/ https://keepassxc.org/ [2] : https://syncthing.net/ https://syncthing.net/

maccard 9y ago
I use a similar combo (keepssX+keepass touch with Dropbox to sync), and frankly it’s a pain. There is no support at all in KeepassX for Dropbox or other sync methods, and they’re not interested in providing it either, stating that a few triggers to auto synchronise is a viable solution. Until an open source project takes multi device seriously, they don’t get mainstream adoption.
- Digit-Al 9y ago
  Have a look at Password Safe. It has an Android version as well as a Windows version (and Linux I think). The Android version has PasswordSafe Synch, which allows it to automatically synchronise your password vault when hosted on a variety of online storage solutions including Dropbox and Google Drive. Plus the Android version has a custom keyboard for entering user name, password, etc... without having to copy/paste.
- slavik81 9y ago
  I don't understand what "Dropbox support" is. Dropbox will sync any file.
  - jhasse 9y ago
    I'd guess merge support in case of conflict and web GUI access.
    - maccard 9y ago
      No, keepass’s recommended approach is a total PITA to set up, and completely non-intuitive [0]. [0] https://keepass.info/help/kb/trigger_examples.html#dbsync https://keepass.info/help/kb/trigger_examples.html#dbsync

lawl 9y ago

This site doesn't answer the question 'why'. Keepass usage seems pretty widespread. Okay Keepass doesn't integrate too well into browsers. But then why not just fix Keepass? There have been way too many products pushed out failed utterly and abandoned by mozilla in the last few years. Why should I care about this one, if it doesn't even tell me what it wants to do better than other products. The text on the website reads like this is simply a POC for a new built-in password manager in firefox, is that correct? But then why standalone?

0xTJ 9y ago
I've been using KeeFox (now Kee) and I like it. It's not perfect, but it works well with KeePass. That, along with Dropbox syncing, and the app Keepass2Android make it my preferred method for password management.
laurent123456 9y ago
Keepass does not provide anything to sync passwords between devices which seems to be an important part of Lockbox.
- hanbura 9y ago
  If anything, I would have said that KeePass provides too many ways to sync devices... KeePass has a feature to sync two files, and can access a variety of network storages. That's not one turn-key solution, but it covers just about everything. Meanwhile I simply store the file in my Dropbox because I don't do concurrent edits and it's slightly more convenient that way
  - hanklazard 9y ago
    Agreed. Dropbox + KeepassXC has been a great combo for me.
    - mariusmg 9y ago
      >Dropbox Honest question, but pushing your KeepassXC db into Dropbox shouldn't raise some red flags from a security perspective ? If "somebody" gets your encrypted db, they can rainbowtable the crap out of it to unlock it. To me it seems by using Dropbox you just add another sizeable attack surface.

raimue 9y ago

This looks interesting to finally replace the outdated Firefox password manager. It is especially important as it was recently shown that the protection by the "master password" does not meet modern security standards. But what exactly is "stand-alone" supposed to mean in this context? At the moment it is distributed as a Firefox extension that replaces the Firefox password manager. This seems like the opposite of "stand-alone" to me, as you cannot use it without Firefox.

willart4food 9y ago

Narcissists and sociopaths dismiss someone's success with "You were lucky". The appropriate response in those cases is: FU.

Flimm 9y ago

Does this offer any password-sharing features? Can you share some passwords with other Mozilla/Firefox accounts?

cpeterso 9y ago
Not yet. Lockbox's stored passwords will be integrated with Firefox Accounts sync before it is released.

alexghr 9y ago

Installed it from the website, logged-in with my Firefox account and got redirected to allizom.org ("Mozilla" spelled backwards!) which has an untrusted certificate. Not a great first experience :(

cpeterso 9y ago
What Firefox version are you running? This sounds like Firefox bug 1411646, which should have been fixed in Firefox 58: https://bugzilla.mozilla.org/show_bug.cgi?id=1411646 https://bugzilla.mozilla.org/show_bug.cgi?id=1411646
- alexghr 9y ago
  I'm on 59.0.1 (64-bit) for Ubuntu Artful (from the official repos). This is quite an odd bug, thanks for the link (and the link from the sibling comment). I'll keep an eye on the bug reports :)
devinreams 9y ago
Hmmm, it may also be a symptom of something similar we've seen intermittently here: https://bugzilla.mozilla.org/show_bug.cgi?id=1424397 https://bugzilla.mozilla.org/show_bug.cgi?id=1424397

KirinDave 9y ago

So... Did this initiative appear because it came out that Firefox was using an ancient and astoundingly insecure practice for its prior password storage product? Given Firefox was only 2 years ago so insecure it wasn't even a valid target for most browser pwn competitions, and just in this year we find out important code is still held over from those days, I'm not sure why anyone should trust Firefox.

cpeterso 9y ago
This is not a brand new project. The first Lockbox alpha release was back in September 2017: https://github.com/mozilla-lockbox/lockbox-extension/releases?after=0.1.1-alpha1 https://github.com/mozilla-lockbox/lockbox-extension/release...
deleted 9y ago
[deleted]

cajdavidson 9y ago

I've recently moved from Lastpass to using Pass[0] & BrowserPass[1], just as convenient and allows me to manage the storing of passwords myself. All files are PGP encrypted. Storing my passwords in my self hosted GIT allows them to be checked out on to my tablet and phone for convenience as well. [0] https://www.passwordstore.org/ https://www.passwordstore.org/ [1] https://github.com/dannyvankooten/browserpass https://github.com/dannyvankooten/browserpass

syx 9y ago
Same here, pass does its job and works like a charm. I haven't tried BrowserPass yet, but it's something I'll definitely look into.
freedomben 9y ago
Did you move away from Lastpass for any reasons other than self-storage/management of passwords? Anecdotally it seems like a lot of people are losing trust in Lastpass. Just curious if this describes you as well.
- craftyguy 9y ago
  not gp, but I did the same thing a few years back (well, lastpass->keepass->pass/git) primarily because I was sick of using a proprietary walled garden. The main benefit of pass, for me, is that it's literally just gpg-encrypted text files. I can access my passwords even if I do not have pass installed, as long as I have my gpg private key. Using git to sync passwords makes it even better! The android Password Store app (on f-droid) is a great graphical interface to my pass files, including handling git syncs.
  - cajdavidson 9y ago
    +1 for the Password Store app, I happen to use an Android tablet and an iPhone and the "Pass" app on iPhone works just as well too (and includes touchID).
  - 0xfeba 9y ago

conradev 9y ago

> The Lockbox extension is a simple, stand-alone password manager that works with Firefox for desktop So it's stand-alone, but I need Firefox to use it?

333c 9y ago
I think they mean that it isn't baked in to Firefox. But I agree that that's a weird choice of wording.