5 ms·

What I love on KeePassXC: * Runs on Linux/Mac/Windows and there are compatible clients for Android. Make your own cloud with a RaspberryPi referred by a DDNS a

What I love on KeePassXC: * Runs on Linux/Mac/Windows and there are compatible clients for Android. Make your own cloud with a RaspberryPi referred by a DDNS and you'll have super powers. * Auto-type. Is tricky to get it working but once you get it you'll become addicted. * The UI makes it much easier to copy and paste fields and the notes are clearly visible. I often use the notes to store things like github tokens (for git), etc. However, I keep 2FA TOTP codes on my Pebble watch only. If you keep 2FA codes on the same file as your password then it isn't 2 Factor anymore, right? Little things that bothered me: * It took me a while to understand how does the Touch ID/fingertip reader works (you need to turn on the checkbox, press Ok on the authentication modal and then touch the reader). Touch ID is one of those things that suddenly you discover you can't live without. * The browser add-ins are not always smooth and friction-less. Sometimes you need to reload the page, reopen the db. Chrome's add-in is the hardest to get working. Firefox's is better. * Edit: forget this. As varjolintu explains bellow, this is wrong. ~~You can't have multiple addresses per entry. Some sites will login with different URL's and KeepassXC will not recognize all.~~ But I am still a fan. I'd give it a 8/10.

varjolintu 5y ago
You can have multiple URL's per entry. However, those only work with the browser extension. Edit entry and go to Browser Integration tab. There's a list of additional URL's.
- diego_moita 5y ago
  Wow! Now I feel stupid. Thank you. That's very cool.
  - joshuajill 5y ago
    On Linux at least you don't really need a browser extension and can arguably reduce the attack surface You can use global Auto-type which brings up Keepass window where you can pick from relevant entries. You can a Global keyboard shortcut and it will work mostly anywhere.
    - rraghur 5y ago
      another tip - ff has an extension that adds the page's url to the title bar. This helps keepass autotype work better since it has a url to match https://addons.mozilla.org/en-US/firefox/addon/add-url-to-window-title/ https://addons.mozilla.org/en-US/firefox/addon/add-url-to-wi...
- ajot 5y ago
  I use clones of older entries if I need multiple URLs. I didn't know about this, thanks!
deleted 5y ago
[deleted]
jabroni_salad 5y ago
One of the things I like about the auto-type is that you can reconfigure it on a per-site basis in case the login sequence isn't the usual. I can have it page through my company's sso labrynth, enter tenancy IDs, trigger my preferred duo method or even navigate to a subpage after logging in. With most other PW managers you are just left with what it gives you and if it doesn't detect the logon fields, that's just too bad. I can also make it auto-type into remote sessions, non-browser applications, and """""extremely secure""""" fields that don't allow you to paste into them. I do use the 'url in title bar' browser extension (there are a lot of these) to help it lock on properly.
- WHA8m 5y ago
  I really like the DELAY function. YouTube is one of those sites where they have email and password on different cards/sites, so I can just add a delay of about 3 seconds and the auto fill in will work:)
  - nerdponx 5y ago
    There is also a "username-only option for this site" popup that sometimes can detect this kind of login flow, and usually handles it correctly.
tormock 5y ago
> Edit: forget this. As varjolintu explains bellow, this is wrong. ~~You can't have multiple addresses per entry. Some sites will login with different URL's and KeepassXC will not recognize all.~~ Create 2 entries for the same site and install the Keepass helper (url in title) addon
nkg 5y ago
I love it and I didn't know of any of these features! :)
Melatonic 5y ago
I may have to push my company to switch to this - now if only they would release their own Android / iOS client! I know there are decent options for both mobile devices but it is harder to pitch a piece of software with multiple vendors than a single, unified vendor when security is a top concern.
BaseballPhysics 5y ago
> The UI makes it much easier to copy and paste fields and the notes are clearly visible. I often use the notes to store things like github tokens (for git), etc. However, I keep 2FA TOTP codes on my Pebble watch only. If you keep 2FA codes on the same file as your password then it isn't 2 Factor anymore, right? Technically no, but whether or not that is a problem depends on the threats you're worried about. I'm personally most worried about 1. credential stuffing, 2. keyloggers/client exploits, and 3. Phishing/MITM attacks. Using a password database allows me to use different passwords for every site, which defeats #1. TOTP even if it's in the same database solves for #2 since simply scraping the password isn't enough to gain access. And #3 isn't addressed at all, even if you use a separate device for TOTP. What I'm not especially worried about is specific targeted attacks where the attacker is attempting to acquire my database and crack it. Now, if you store your password database on someone else's cloud, that could become more of a concern, as a mass breach and bulk collection of databases becomes a possible attack vector. But I use syncthing to directly share my DB between devices, so I'm not particularly worried about that. If you're worried about either of those threats, then a separate TOTP device is absolutely vital. But, for me personally, the inconvenience of it is not worth the additional security.

varjolintu 5y ago

You can have multiple URL's per entry. However, those only work with the browser extension. Edit entry and go to Browser Integration tab. There's a list of additional URL's.

diego_moita 5y ago
Wow! Now I feel stupid. Thank you. That's very cool.
- joshuajill 5y ago
  On Linux at least you don't really need a browser extension and can arguably reduce the attack surface You can use global Auto-type which brings up Keepass window where you can pick from relevant entries. You can a Global keyboard shortcut and it will work mostly anywhere.
  - rraghur 5y ago
    another tip - ff has an extension that adds the page's url to the title bar. This helps keepass autotype work better since it has a url to match https://addons.mozilla.org/en-US/firefox/addon/add-url-to-window-title/ https://addons.mozilla.org/en-US/firefox/addon/add-url-to-wi...
ajot 5y ago
I use clones of older entries if I need multiple URLs. I didn't know about this, thanks!

deleted 5y ago

[deleted]

jabroni_salad 5y ago

One of the things I like about the auto-type is that you can reconfigure it on a per-site basis in case the login sequence isn't the usual. I can have it page through my company's sso labrynth, enter tenancy IDs, trigger my preferred duo method or even navigate to a subpage after logging in. With most other PW managers you are just left with what it gives you and if it doesn't detect the logon fields, that's just too bad. I can also make it auto-type into remote sessions, non-browser applications, and """""extremely secure""""" fields that don't allow you to paste into them. I do use the 'url in title bar' browser extension (there are a lot of these) to help it lock on properly.

WHA8m 5y ago
I really like the DELAY function. YouTube is one of those sites where they have email and password on different cards/sites, so I can just add a delay of about 3 seconds and the auto fill in will work:)
- nerdponx 5y ago
  There is also a "username-only option for this site" popup that sometimes can detect this kind of login flow, and usually handles it correctly.

tormock 5y ago

> Edit: forget this. As varjolintu explains bellow, this is wrong. ~~You can't have multiple addresses per entry. Some sites will login with different URL's and KeepassXC will not recognize all.~~ Create 2 entries for the same site and install the Keepass helper (url in title) addon

nkg 5y ago

I love it and I didn't know of any of these features! :)

Melatonic 5y ago

I may have to push my company to switch to this - now if only they would release their own Android / iOS client! I know there are decent options for both mobile devices but it is harder to pitch a piece of software with multiple vendors than a single, unified vendor when security is a top concern.

BaseballPhysics 5y ago

> The UI makes it much easier to copy and paste fields and the notes are clearly visible. I often use the notes to store things like github tokens (for git), etc. However, I keep 2FA TOTP codes on my Pebble watch only. If you keep 2FA codes on the same file as your password then it isn't 2 Factor anymore, right? Technically no, but whether or not that is a problem depends on the threats you're worried about. I'm personally most worried about 1. credential stuffing, 2. keyloggers/client exploits, and 3. Phishing/MITM attacks. Using a password database allows me to use different passwords for every site, which defeats #1. TOTP even if it's in the same database solves for #2 since simply scraping the password isn't enough to gain access. And #3 isn't addressed at all, even if you use a separate device for TOTP. What I'm not especially worried about is specific targeted attacks where the attacker is attempting to acquire my database and crack it. Now, if you store your password database on someone else's cloud, that could become more of a concern, as a mass breach and bulk collection of databases becomes a possible attack vector. But I use syncthing to directly share my DB between devices, so I'm not particularly worried about that. If you're worried about either of those threats, then a separate TOTP device is absolutely vital. But, for me personally, the inconvenience of it is not worth the additional security.