6 ms·

This site doesn't answer the question 'why'. Keepass usage seems pretty widespread. Okay Keepass doesn't integrate too well into browsers. But then why not jus

by lawl 9y ago

This site doesn't answer the question 'why'. Keepass usage seems pretty widespread. Okay Keepass doesn't integrate too well into browsers. But then why not just fix Keepass? There have been way too many products pushed out failed utterly and abandoned by mozilla in the last few years. Why should I care about this one, if it doesn't even tell me what it wants to do better than other products. The text on the website reads like this is simply a POC for a new built-in password manager in firefox, is that correct? But then why standalone?

0xTJ 9y ago
I've been using KeeFox (now Kee) and I like it. It's not perfect, but it works well with KeePass. That, along with Dropbox syncing, and the app Keepass2Android make it my preferred method for password management.
laurent123456 9y ago
Keepass does not provide anything to sync passwords between devices which seems to be an important part of Lockbox.
- hanbura 9y ago
  If anything, I would have said that KeePass provides too many ways to sync devices... KeePass has a feature to sync two files, and can access a variety of network storages. That's not one turn-key solution, but it covers just about everything. Meanwhile I simply store the file in my Dropbox because I don't do concurrent edits and it's slightly more convenient that way
  - hanklazard 9y ago
    Agreed. Dropbox + KeepassXC has been a great combo for me.
    - mariusmg 9y ago
      >Dropbox Honest question, but pushing your KeepassXC db into Dropbox shouldn't raise some red flags from a security perspective ? If "somebody" gets your encrypted db, they can rainbowtable the crap out of it to unlock it. To me it seems by using Dropbox you just add another sizeable attack surface.
      - staticassertion 9y ago
        I don't see how Dropbox is related to rainbow tables - presumably KeepassX uses a salt.
      - paulryanrogers 9y ago
        True, and SQRL has a similar weakness. Keepass does offer some choice in rounds and algorithm. So that can offer some protection.
      - hanbura 9y ago
        To me the entire point of a password manager is to solve password reuse. I can only remember a small number of high-quality passwords. I use one of those to secure my password manager, and I consider that password good enough to be unbreakable even if stored with a simple unsalted hash (and I know KeePass does much better). I would be comfortable hosting my password file publicly. Any benefits from Dropbox authentication are just defense in depth (and privacy benefits).
      - zaarn 9y ago
        They can't. Keepass uses a Salt (and Nonce) for the key derivation. Modern settings also include Argon2 (which I have enabled for my DB), which excludes everything but CPUs from efficient cracking. The DB attack surface is to some extend expected to be eventually obtained by an attacker. As long as your master password is nice and long, they "can't do shit" for a long long long while.
  - laurent123456 9y ago
    Yes but does it sync with Firefox browser directly on Android? I'm using Keepass2Android which is not that convenient. Direct integration in the browser like what Mozilla is doing would be better.
- mehrdadn 9y ago
  What? Just look up Keepass2Android etc.
mastax 9y ago
1. Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. 2. Browsers need to be trusted and secure. If you use Firefox, you are trusting Mozilla et. al. to have the policies, procedures, motivations, and expertise to create secure software that protects your privacy. If you can trust them to make your browser, you can trust them to make your password manager. I do hope that Mozilla answers these questions directly when/before this moves out of beta.
- lawl 9y ago
  1. Yes but that doesn't answer the standalone question. 2. I do trust Mozilla to have the technical expertise to build a secure password manager. But just because they can do it, still doesn't answer why they're doing it the way they're doing it. I would just like to hear Mozillas thought process that went into this. I'm sure they have reasons for all decisions, but I can't read thoughts. Knowing their thought process would help me evaluate my prediction of this being abandon-ware in half a year.
- josteink 9y ago
  > Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. I'd like to see this discussion. For me, I find Firefox's password manager the only one I can bother using, because it offers a good and seamless UX, right where I need it. If they "fix" that by making it terrible like Lastpass, I honestly don't know what I'll do.
  - akquise 9y ago
    > I'd like to see this discussion. Concerning the "security standpoint", probably this news [0] is meant. Hashing the password with SHA-1 using 1 iteration may be referred to as "inadequate". [0] https://www.bleepingcomputer.com/news/security/firefox-master-password-system-has-been-poorly-secured-for-the-past-9-years/ https://www.bleepingcomputer.com/news/security/firefox-maste...
pbreit 9y ago
And not totally clear that it's a (official?) Mozilla effort.
- floatingatoll 9y ago
  It’s an official Mozilla effort, given that it’s discussed as a key item in our roadmap update four days ago.
mintplant 9y ago
> There have been way too many products pushed out failed utterly and abandoned by mozilla in the last few years. Have there? Off the top of my head there's Persona and Firefox OS, the latter of which Mozilla kept trying to push on with long after the rest of the world had concluded it was doomed. Meanwhile we got Rust and Focus out of Mozilla.
- lawl 9y ago
  There was abloginnservice before persona iirc. Firefox hello. thunderbird. I'm sure there are more, but those come to mind imediately.
  - mariusmg 9y ago
    >thunderbird Not abandoned, i'm using it, i'm happy with it, thank you very much.
    - lawl 9y ago
      It's not developed by Mozilla anymore though. It's a community project now. So yes, is is abandoned by mozilla.
      - e1ven 9y ago
        It's more complicated than that. Mozilla is financially sponsoring Thunderbird, and helping to aid in development. I'd love for them to do more, but I understand why local mail clients aren't a growth area. https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-future-home/ https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-fu...
  - mintplant 9y ago
    Firefox Hello stands out to me as another case of Mozilla stubbornly trying to make something work for much longer than anyone on the outside would have advised. It started as an intern project to demo WebRTC and persisted for 3 years amidst incessant predictions of its doom. Thunderbird has received continuous development and maintenance for coming up on 15 years since its public release.
l1ambda 9y ago
KeepassXC browser integration actually works well.
- g4k 9y ago
  The KeepassXC browser plugins do not work on many websites. It is absolutely not comparable to the quality of the 1Password plugins. Currently I am testing Enpass, which works well so far.
- batisteo 9y ago
  …if you keep KeepassXC open in background and unlocked. Bad UX for me.
  - paulryanrogers 9y ago
    Same concern here, that's why I made LockyWindow for Keepass (original). It's a shame there isn't a way to use an interchangable format at the OS level for Macos Keychain, Gnome Keyring, Windows crypto, etc.

by lawl 9y ago

0xTJ 9y ago

I've been using KeeFox (now Kee) and I like it. It's not perfect, but it works well with KeePass. That, along with Dropbox syncing, and the app Keepass2Android make it my preferred method for password management.

laurent123456 9y ago

Keepass does not provide anything to sync passwords between devices which seems to be an important part of Lockbox.

hanbura 9y ago
If anything, I would have said that KeePass provides too many ways to sync devices... KeePass has a feature to sync two files, and can access a variety of network storages. That's not one turn-key solution, but it covers just about everything. Meanwhile I simply store the file in my Dropbox because I don't do concurrent edits and it's slightly more convenient that way
- hanklazard 9y ago
  Agreed. Dropbox + KeepassXC has been a great combo for me.
  - mariusmg 9y ago
    >Dropbox Honest question, but pushing your KeepassXC db into Dropbox shouldn't raise some red flags from a security perspective ? If "somebody" gets your encrypted db, they can rainbowtable the crap out of it to unlock it. To me it seems by using Dropbox you just add another sizeable attack surface.
    - staticassertion 9y ago
      I don't see how Dropbox is related to rainbow tables - presumably KeepassX uses a salt.
    - paulryanrogers 9y ago
      True, and SQRL has a similar weakness. Keepass does offer some choice in rounds and algorithm. So that can offer some protection.
    - hanbura 9y ago
      To me the entire point of a password manager is to solve password reuse. I can only remember a small number of high-quality passwords. I use one of those to secure my password manager, and I consider that password good enough to be unbreakable even if stored with a simple unsalted hash (and I know KeePass does much better). I would be comfortable hosting my password file publicly. Any benefits from Dropbox authentication are just defense in depth (and privacy benefits).
    - zaarn 9y ago
      They can't. Keepass uses a Salt (and Nonce) for the key derivation. Modern settings also include Argon2 (which I have enabled for my DB), which excludes everything but CPUs from efficient cracking. The DB attack surface is to some extend expected to be eventually obtained by an attacker. As long as your master password is nice and long, they "can't do shit" for a long long long while.
- laurent123456 9y ago
  Yes but does it sync with Firefox browser directly on Android? I'm using Keepass2Android which is not that convenient. Direct integration in the browser like what Mozilla is doing would be better.
mehrdadn 9y ago
What? Just look up Keepass2Android etc.

mastax 9y ago

1. Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. 2. Browsers need to be trusted and secure. If you use Firefox, you are trusting Mozilla et. al. to have the policies, procedures, motivations, and expertise to create secure software that protects your privacy. If you can trust them to make your browser, you can trust them to make your password manager. I do hope that Mozilla answers these questions directly when/before this moves out of beta.

lawl 9y ago
1. Yes but that doesn't answer the standalone question. 2. I do trust Mozilla to have the technical expertise to build a secure password manager. But just because they can do it, still doesn't answer why they're doing it the way they're doing it. I would just like to hear Mozillas thought process that went into this. I'm sure they have reasons for all decisions, but I can't read thoughts. Knowing their thought process would help me evaluate my prediction of this being abandon-ware in half a year.
josteink 9y ago
> Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. I'd like to see this discussion. For me, I find Firefox's password manager the only one I can bother using, because it offers a good and seamless UX, right where I need it. If they "fix" that by making it terrible like Lastpass, I honestly don't know what I'll do.
- akquise 9y ago
  > I'd like to see this discussion. Concerning the "security standpoint", probably this news [0] is meant. Hashing the password with SHA-1 using 1 iteration may be referred to as "inadequate". [0] https://www.bleepingcomputer.com/news/security/firefox-master-password-system-has-been-poorly-secured-for-the-past-9-years/ https://www.bleepingcomputer.com/news/security/firefox-maste...

pbreit 9y ago

And not totally clear that it's a (official?) Mozilla effort.

floatingatoll 9y ago
It’s an official Mozilla effort, given that it’s discussed as a key item in our roadmap update four days ago.

mintplant 9y ago

> There have been way too many products pushed out failed utterly and abandoned by mozilla in the last few years. Have there? Off the top of my head there's Persona and Firefox OS, the latter of which Mozilla kept trying to push on with long after the rest of the world had concluded it was doomed. Meanwhile we got Rust and Focus out of Mozilla.

lawl 9y ago
There was abloginnservice before persona iirc. Firefox hello. thunderbird. I'm sure there are more, but those come to mind imediately.
- mariusmg 9y ago
  >thunderbird Not abandoned, i'm using it, i'm happy with it, thank you very much.
  - lawl 9y ago
    It's not developed by Mozilla anymore though. It's a community project now. So yes, is is abandoned by mozilla.
    - e1ven 9y ago
      It's more complicated than that. Mozilla is financially sponsoring Thunderbird, and helping to aid in development. I'd love for them to do more, but I understand why local mail clients aren't a growth area. https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-future-home/ https://blog.mozilla.org/thunderbird/2017/05/thunderbirds-fu...
- mintplant 9y ago
  Firefox Hello stands out to me as another case of Mozilla stubbornly trying to make something work for much longer than anyone on the outside would have advised. It started as an intern project to demo WebRTC and persisted for 3 years amidst incessant predictions of its doom. Thunderbird has received continuous development and maintenance for coming up on 15 years since its public release.

l1ambda 9y ago

KeepassXC browser integration actually works well.

g4k 9y ago
The KeepassXC browser plugins do not work on many websites. It is absolutely not comparable to the quality of the 1Password plugins. Currently I am testing Enpass, which works well so far.
batisteo 9y ago
…if you keep KeepassXC open in background and unlocked. Bad UX for me.
- paulryanrogers 9y ago
  Same concern here, that's why I made LockyWindow for Keepass (original). It's a shame there isn't a way to use an interchangable format at the OS level for Macos Keychain, Gnome Keyring, Windows crypto, etc.