3 ms·

What's the difference between KeePassXC and KeePass? They both seem to be recently updated. Currently using BitWarden and I like the sync, the browser integra

What's the difference between KeePassXC and KeePass? They both seem to be recently updated. Currently using BitWarden and I like the sync, the browser integration, and availability on Android.

vbezhenar 6y ago
Keepass is made with .NET. It’s native for Windows. It works with other OS using Mono, but it’s not as native, I guess. KeepassXC written with C++ and crossplatform GUI, so it’s better fit with Linux and macOS. Also, AFAIK, KeepassXC has more features. I’m using Keepass because I trust C# more than I trust C++ when it comes to security. But it’s nice to have options.
jasode 6y ago
The website page of this release also has a FAQ that answers your question: https://keepassxc.org/docs/#faq-keepassx https://keepassxc.org/docs/#faq-keepassx tldr is : C# (canonical project) -- vs -- C++ (older project) -- vs -- C++ (newer project)
fisian 6y ago
KeePass uses .Net/mono to run on all platforms, while KeePassXC has a more "native" feel. KeePass has many plugins available, which allow extending its behavior. KeePassXC doesn't have plugins, but has many quality of live things built-in. I used both, but currently use KeePassXC. I really love its ssh key integration.
stuckindider 6y ago
Keepass's website uses http because switching to https may hurt advertising revenue.
- mywittyname 6y ago
  https://keepass.info/ https://keepass.info/ Looks like it uses HTTPS to me. What you're referring to is an old (fixed roughly six years ago), and highly misrepresented situation discussed here: https://keepass.info/help/kb/sec_issues.html#updsig https://keepass.info/help/kb/sec_issues.html#updsig
  - stuckindider 6y ago
    What you linked isn't talking about the entire site. It literally says that the signature page is secure. But they don't mention the entire site being secure. I wonder why... Here it is 3.5 years ago being hosted over http and not redirecting to https. It looks like they changed in 2018. https://web.archive.org/web/20170907194943/http://keepass.info/ https://web.archive.org/web/20170907194943/http://keepass.in...
    - mywittyname 6y ago
      The "security issue" you're talking about was that the URL used to determine if there is a new version available was HTTP-only. People felt like this was a security concern because it was susceptible to a MitM attack. The author felt like this was a none-issue because Keepass did not self-update at all, the URL was only used to inform the user of a new version. So a successful MitM attack would merely inform the user of a new version. New version of the software were served via mirrors and digital signatures for all versions were made available. Standard security practice for the era was to verify the digital signatures of software before installing it because so much software was served by third parties. Also, this all happened before HTTPS was ubiquitous (the patch to force version checks to use HTTPS came in 2016). Most sites still served traffic over regular HTTP, with only logins and purchase pages using encryption.

What's the difference between KeePassXC and KeePass? They both seem to be recently updated. Currently using BitWarden and I like the sync, the browser integration, and availability on Android.

vbezhenar 6y ago

Keepass is made with .NET. It’s native for Windows. It works with other OS using Mono, but it’s not as native, I guess. KeepassXC written with C++ and crossplatform GUI, so it’s better fit with Linux and macOS. Also, AFAIK, KeepassXC has more features. I’m using Keepass because I trust C# more than I trust C++ when it comes to security. But it’s nice to have options.

jasode 6y ago

The website page of this release also has a FAQ that answers your question: https://keepassxc.org/docs/#faq-keepassx https://keepassxc.org/docs/#faq-keepassx tldr is : C# (canonical project) -- vs -- C++ (older project) -- vs -- C++ (newer project)

fisian 6y ago

KeePass uses .Net/mono to run on all platforms, while KeePassXC has a more "native" feel. KeePass has many plugins available, which allow extending its behavior. KeePassXC doesn't have plugins, but has many quality of live things built-in. I used both, but currently use KeePassXC. I really love its ssh key integration.

stuckindider 6y ago

Keepass's website uses http because switching to https may hurt advertising revenue.

mywittyname 6y ago
https://keepass.info/ https://keepass.info/ Looks like it uses HTTPS to me. What you're referring to is an old (fixed roughly six years ago), and highly misrepresented situation discussed here: https://keepass.info/help/kb/sec_issues.html#updsig https://keepass.info/help/kb/sec_issues.html#updsig
- stuckindider 6y ago
  What you linked isn't talking about the entire site. It literally says that the signature page is secure. But they don't mention the entire site being secure. I wonder why... Here it is 3.5 years ago being hosted over http and not redirecting to https. It looks like they changed in 2018. https://web.archive.org/web/20170907194943/http://keepass.info/ https://web.archive.org/web/20170907194943/http://keepass.in...
  - mywittyname 6y ago
    The "security issue" you're talking about was that the URL used to determine if there is a new version available was HTTP-only. People felt like this was a security concern because it was susceptible to a MitM attack. The author felt like this was a none-issue because Keepass did not self-update at all, the URL was only used to inform the user of a new version. So a successful MitM attack would merely inform the user of a new version. New version of the software were served via mirrors and digital signatures for all versions were made available. Standard security practice for the era was to verify the digital signatures of software before installing it because so much software was served by third parties. Also, this all happened before HTTPS was ubiquitous (the patch to force version checks to use HTTPS came in 2016). Most sites still served traffic over regular HTTP, with only logins and purchase pages using encryption.