7 ms·

i have been a hardened user of keepass and it is strange to find people who "HATE" the idea of keepass over anything online, bitwarden or lastpass or 1password

i have been a hardened user of keepass and it is strange to find people who "HATE" the idea of keepass over anything online, bitwarden or lastpass or 1password or whatever BS "zero knowledge backup" or other nonsense. you dont need to have LIVE SYNCING for your passwords. i have a keepass on my laptop and its copy on my phone. if occasionally i have to update anything, i do that and copy the file to the other place. say i update on the phone so next time i just share the file to the laptop and i am synced. this "janky" method has worked for over 5-7 years now without any problems so i dont understand why anyone wants to "keep live sync" enabled for such things and have to pay someone for the privilege and then have to wait for them to get hacked. nonsense

h2rra 4y ago
I keep the file in dropbox so it syncs to all the devices.
- 2Gkashmiri 4y ago
  good for you. are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? probably but that would mean keepass has been broken, something that hasnt been the case so whats the problem?
  - Ekaros 4y ago
    And if that was the case wouldn't same risk profile apply to something hacking the file from your device?
    - 2Gkashmiri 4y ago
      sure. where do you draw the line? mind- your own mind/post-it notes- you forget and you loose notes offline- keepass- works. is safe. has not been broken online- whatever SAAS- works but only pinky promise of being unhackable- can leak from beyond your own control. your keepass could be hacked but they would require access to your device. you have control over that. you do not have control over lastpass servers
      - hackernewds 4y ago
        best to use what is the most secure. your own brain?
    - CyanBird 4y ago
      Dropbox famously worked with the NSA sharing both encrypted user data as well as decrypted user data... I would not use them for anything sensitive ever.... But you do you I guess
  - TMWNN 4y ago
    >are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? I keep a copy of my password file in Dropbox, as one of several backups. (The file, to begin with, is GPG-encrypted.)
Starz0r 4y ago
Glad that method works out for you. Fortunately for the rest of the world, technology has progressed far enough that Password Storage is a solved problem. I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. Some people would rather entrust a reputable service to handle the very menial task of managing their passwords for them, rather than go through the hassle of doing it themselves. Not only do these services provide better convenience, they make you more secure! Many people reuse the same password, so when a site gets "owned", any site using that same password is now compromised as well. Some of these services will even automatically tell you when a site gets "owned" and offer to change that password for you retroactively. Now, if you want to go ahead and use a local only method, be my guest. But please, don't ever suggest to anyone else that they should do the same, that's just bad security advice! By the way, getting hacked in the password manager does not mean all your passwords leaked. It just means some extra metadata about you may get discovered, which I'd argue is a reasonable trade-off.
- 2Gkashmiri 4y ago
  >I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. this should be taught in schools if that is your concern. what i am doing with the "manual sync" for files is because i have 2 machines i want to get my passwords. there is a HUGE population who only have a phone. for them, keepassdroid or some other keepass app is the only thing that they should ever need or use. i know because i have set up the files for my family members, they only have their phones at hand and the file has served them well for years without any problem. now they "whatsapp or email" the file to themselves or to me if they have to change their phone and get it back in a matter of minutes. this is not as big of a deal that you need to have online tied system and be a techie otherwise
  - eternityforest 4y ago
    If I only had a phone, I would definitely want live sync, so I had a chance of recovery if my phone was gone. Keepass isn't even something I'd consider. I'm not sure what you're referring to that should be taught in schools. The problem of forgetting things is often "human error" not "pilot error", a random packet loss of the mind rather than lack of skill. There's strategies to mitigate it, like always leaving the house with the same set of items and never changing it up, and avoiding situations where you rely on memory, but live sync is going to prevent a lot of mistakes.
c22 4y ago
I keep my passwords in my head. This has worked for over 30 years.
- c22 4y ago
  I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game? My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc. Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?
  - camgunz 4y ago
    As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons: - people forget - you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords - this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because: - you don't store passwords - you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password) - your users can't forget their passwords - it's pretty much just as secure as your email, which is probably gmail, which is fine I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.
fragmede 4y ago
Why don't I want live syncing between my phone and my laptop? I use my phone quite a lot despite my laptop being within an arm length or two. Having new passwords accessible between them seems like an obviously useful thing.

h2rra 4y ago

I keep the file in dropbox so it syncs to all the devices.

2Gkashmiri 4y ago
good for you. are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? probably but that would mean keepass has been broken, something that hasnt been the case so whats the problem?
- Ekaros 4y ago
  And if that was the case wouldn't same risk profile apply to something hacking the file from your device?
  - 2Gkashmiri 4y ago
    sure. where do you draw the line? mind- your own mind/post-it notes- you forget and you loose notes offline- keepass- works. is safe. has not been broken online- whatever SAAS- works but only pinky promise of being unhackable- can leak from beyond your own control. your keepass could be hacked but they would require access to your device. you have control over that. you do not have control over lastpass servers
    - hackernewds 4y ago
      best to use what is the most secure. your own brain?
  - CyanBird 4y ago
    Dropbox famously worked with the NSA sharing both encrypted user data as well as decrypted user data... I would not use them for anything sensitive ever.... But you do you I guess
- TMWNN 4y ago
  >are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? I keep a copy of my password file in Dropbox, as one of several backups. (The file, to begin with, is GPG-encrypted.)

Starz0r 4y ago

Glad that method works out for you. Fortunately for the rest of the world, technology has progressed far enough that Password Storage is a solved problem. I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. Some people would rather entrust a reputable service to handle the very menial task of managing their passwords for them, rather than go through the hassle of doing it themselves. Not only do these services provide better convenience, they make you more secure! Many people reuse the same password, so when a site gets "owned", any site using that same password is now compromised as well. Some of these services will even automatically tell you when a site gets "owned" and offer to change that password for you retroactively. Now, if you want to go ahead and use a local only method, be my guest. But please, don't ever suggest to anyone else that they should do the same, that's just bad security advice! By the way, getting hacked in the password manager does not mean all your passwords leaked. It just means some extra metadata about you may get discovered, which I'd argue is a reasonable trade-off.

2Gkashmiri 4y ago
>I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. this should be taught in schools if that is your concern. what i am doing with the "manual sync" for files is because i have 2 machines i want to get my passwords. there is a HUGE population who only have a phone. for them, keepassdroid or some other keepass app is the only thing that they should ever need or use. i know because i have set up the files for my family members, they only have their phones at hand and the file has served them well for years without any problem. now they "whatsapp or email" the file to themselves or to me if they have to change their phone and get it back in a matter of minutes. this is not as big of a deal that you need to have online tied system and be a techie otherwise
- eternityforest 4y ago
  If I only had a phone, I would definitely want live sync, so I had a chance of recovery if my phone was gone. Keepass isn't even something I'd consider. I'm not sure what you're referring to that should be taught in schools. The problem of forgetting things is often "human error" not "pilot error", a random packet loss of the mind rather than lack of skill. There's strategies to mitigate it, like always leaving the house with the same set of items and never changing it up, and avoiding situations where you rely on memory, but live sync is going to prevent a lot of mistakes.

c22 4y ago

I keep my passwords in my head. This has worked for over 30 years.

c22 4y ago
I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game? My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc. Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?
- camgunz 4y ago
  As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons: - people forget - you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords - this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because: - you don't store passwords - you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password) - your users can't forget their passwords - it's pretty much just as secure as your email, which is probably gmail, which is fine I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.

fragmede 4y ago

Why don't I want live syncing between my phone and my laptop? I use my phone quite a lot despite my laptop being within an arm length or two. Having new passwords accessible between them seems like an obviously useful thing.