6 ms·

I used that for a couple years and switched to lastpass, because I was tired of having to install plugins across all the browsers on a platform and then having

I used that for a couple years and switched to lastpass, because I was tired of having to install plugins across all the browsers on a platform and then having to find workarounds with Dropbox for syncing on additional machines and the lack of a Windows client, when I'm stuck working on Windows. I find that Keepass, with the database saved on my Dropbox folder, works well. No browser integration needed - Keepass registers an OS hotkey (at least on Windows) for ctrl+shift+A which will autotype ${USER}TAB${PASS} in the currently focused field, using the title of the browser window as the entry to look for in the pw database. Great for a free solution.

edanm 16y ago
Seconded. Just wanted to add that it's possible to configure any auto-typing (the default is ${USER}TAB${PASS}), which means sites having all sorts of other info are easy to work with as well. I actually wrote a blog post about using Keepass with various tricks: http://www.loopycode.com/solving-sign-up-anxiety/ http://www.loopycode.com/solving-sign-up-anxiety/
deleted 16y ago
[deleted]
16s 16y ago
In my mind, that's the primary design flaw with traditional password managers. Why should end users store passwords? It introduces so many issues. Must have proper encryption. Must deal with synchronization. Must have master password. The list could go on and on. Passwords should be generated (locally on your device) when needed, and never stored in any way. Edit: Some more negatives to password storage. Must protect stored password file. May be required to log access to stored password file for compliance reasons. Stored password files may become corrupt and stop working.
- brown9-2 16y ago
  I don't think I understand this - if the password isn't stored, do you expect the user to memorize all the various passwords?
  - 16s 16y ago
    End users don't need to memorize any passwords. They don't know them and they do not care what the passwords are (nor should they). They only need to know how to generate them when needed. Read about SHA1_Pass and try it out. I use it (and wrote it) to deal with hundreds of passwords that change frequently. I tried to make traditional password managers work for a number of years, before realizing that the traditional approach (password storage, master password) is fundamentally flawed and introduces more problems than it solves.
    - pzxc 16y ago
      I've looked at SHA1_Pass when it was posted here on HN a while back, and I'm not impressed. You have to memorize a passphrase, which is only marginally easier than remembering a master password, but you also have to remember an individual word for each account/website. Yes this is easier than remembering individual passwords but not as easy as just remembering one master password that unlocks an encrypted database (like Keepass). From the FAQ for SHA1_Pass, it says "when your bank asks you to change your password, just increment your word from BILLS to BILLS1 or BILLS2". More stuff to remember, which BILLS was I on again? Additionally, some accounts have restrictions on usable characters or password length. The FAQ for SHA1_Pass says "try base64 half-encoding, its only 14 characters, and if that's too long maybe you shouldn't be using that website". Well I'm sorry but some BANKS do not allow passwords that long. You and I both know it's idiotic, but some banks have a small maximum password length, and some of them even restrict you to alphanumeric characters only. I applaud SHA1_pass for trying to be innovative, you don't know what works unless you try it, but it looks like the result is a failure to me... too much complexity generated around the goal of trying to make passwords easy to remember, yet hashed to be secure. Just generate a random password with Keepass, whatever length and character sets you want, and store it. What's the big deal? Yes, there's a chance that Keepass didn't do their encryption properly and your master password will be crackable, and someone will hack into your dropbox account and then have all your passwords. But with SHA1_pass there's also a chance someone will guess or socially engineer your passphrase, and since all your site words are "facebook" for facebook etc etc they too have full access to all your accounts.

edanm 16y ago

Seconded. Just wanted to add that it's possible to configure any auto-typing (the default is ${USER}TAB${PASS}), which means sites having all sorts of other info are easy to work with as well. I actually wrote a blog post about using Keepass with various tricks: http://www.loopycode.com/solving-sign-up-anxiety/ http://www.loopycode.com/solving-sign-up-anxiety/

deleted 16y ago

[deleted]

16s 16y ago

In my mind, that's the primary design flaw with traditional password managers. Why should end users store passwords? It introduces so many issues. Must have proper encryption. Must deal with synchronization. Must have master password. The list could go on and on. Passwords should be generated (locally on your device) when needed, and never stored in any way. Edit: Some more negatives to password storage. Must protect stored password file. May be required to log access to stored password file for compliance reasons. Stored password files may become corrupt and stop working.

brown9-2 16y ago
I don't think I understand this - if the password isn't stored, do you expect the user to memorize all the various passwords?
- 16s 16y ago
  End users don't need to memorize any passwords. They don't know them and they do not care what the passwords are (nor should they). They only need to know how to generate them when needed. Read about SHA1_Pass and try it out. I use it (and wrote it) to deal with hundreds of passwords that change frequently. I tried to make traditional password managers work for a number of years, before realizing that the traditional approach (password storage, master password) is fundamentally flawed and introduces more problems than it solves.
  - pzxc 16y ago
    I've looked at SHA1_Pass when it was posted here on HN a while back, and I'm not impressed. You have to memorize a passphrase, which is only marginally easier than remembering a master password, but you also have to remember an individual word for each account/website. Yes this is easier than remembering individual passwords but not as easy as just remembering one master password that unlocks an encrypted database (like Keepass). From the FAQ for SHA1_Pass, it says "when your bank asks you to change your password, just increment your word from BILLS to BILLS1 or BILLS2". More stuff to remember, which BILLS was I on again? Additionally, some accounts have restrictions on usable characters or password length. The FAQ for SHA1_Pass says "try base64 half-encoding, its only 14 characters, and if that's too long maybe you shouldn't be using that website". Well I'm sorry but some BANKS do not allow passwords that long. You and I both know it's idiotic, but some banks have a small maximum password length, and some of them even restrict you to alphanumeric characters only. I applaud SHA1_pass for trying to be innovative, you don't know what works unless you try it, but it looks like the result is a failure to me... too much complexity generated around the goal of trying to make passwords easy to remember, yet hashed to be secure. Just generate a random password with Keepass, whatever length and character sets you want, and store it. What's the big deal? Yes, there's a chance that Keepass didn't do their encryption properly and your master password will be crackable, and someone will hack into your dropbox account and then have all your passwords. But with SHA1_pass there's also a chance someone will guess or socially engineer your passphrase, and since all your site words are "facebook" for facebook etc etc they too have full access to all your accounts.