17 ms·
KeePassXC pull request to add basic support for WebAuthn
- makepanic 4y ago(last commit from Dec 11, 2022)
- wkat4242 4y agoEh no? The repo has been committed to 7 hours ago. Of course the pull request is pending review but that's not too exceptional.
- makepanic 4y agoYes I'm talking about the PR which sadly didn't really receive any recent review activity
- biscuitech 4y agoThe repo was committed to, yes, but not the linked PR. The linked PR hasn't been updated since December of last year.
- Ajedi32 4y agoYeah, this isn't new. I've been advocating for this since 2018[1], and the PR in question was submitted in November 2022. The PR isn't dead though. There's some additional discussion[2] on its current state in the issue I linked above. Basically, it needs more people to test the implementation against different sites in the wild. Hopefully the increasing popularity of passkeys will provide the necessary level of motivation and support to get this over the finish line. [1]: https://github.com/keepassxreboot/keepassxc/issues/1870 https://github.com/keepassxreboot/keepassxc/issues/1870 [2]: https://github.com/keepassxreboot/keepassxc/issues/1870#issuecomment-1397197380 https://github.com/keepassxreboot/keepassxc/issues/1870#issu...
- account-5 4y agoIf this gets implemented it will be the first step in showing that passkeys are a viable alternative to passwords in a meaningful way. That is, there is no vendor lock in to multinational corps only interested in their bottom line and selling your data. They aren't tied to a device that can be lost, stolen or broken, or requiring you to have multiple devices just in case; and not tied to biometrics. Lastly this means there is a proper open source, offline version that is portable across devices, browsers, and ecosystems. Putting the user back in control.
- wkat4242 4y agoAbsolutely, this is the one reason I'm not interested in passkeys yet. I want to fully own my authentication keys myself. Not trusting Google or Microsoft for that. I hope it comes to zx2c4 pass too <3
- eptcyka 4y agoWith the sad state of PGP on Android, I hope someone picks up development on a viable alternative or ressurrects OpenKeychain. Currently, I cannot use my PGP keys because they're too new on Android.
- wkat4242 4y agoI think OpenKeyChain is pretty great, I still use it. Unfortunately the authors went commercial (heylogin) and this is why they abandoned it. Their new products are very corporate and not interesting to me as an end user. But OKC is really necessary for my entire flow. I use it with password store, with termux (through OKCAgent) and some other things. I hope someone else picks it up too, but as long as they incorporate security fixes it's fine. I use yubikeys for the actual encryption anyway so the only risk is in the symmetric part. But what's the problem with your keys being too new?
- eptcyka 4y agoMy ed25519 keys can't decrypt my secrets due to a parsing error somewhere. I can still use okc-ssh-agent to SSH into places, but I cannot decrypt my passwords, which is kind of a big deal. It's because of this I'll probably migrate to a self-hosted bitwarden and use FIDO auth with my yubikey. I'll still use the GPG key for SSH authentication, but boy is this a mess I don't have any time for. And when I say I don't have the time for, I tried to get OpenKeychain to use a newer version of BouncyCastle, which should support my encrypted files just fine, but boy do I not have the knowledge to deal with changes in a project's gradle structure. I think the root of the issue is that newer versions of GPG have changed the format of the ciphertext in a way that the bouncy castle version OpenKeychain is using doesn't parse. Anyway, I do not feel confident in mucking about in crypto code. Maybe there's hope in just porting a front-end of pass that uses a plain ported GPG implementation instead.
- uglytruth2 4y agoWe all know this is mostly meaningless. The real 'feature' of webAuth is 3rd party attestation. Your bank and soon every other service will see how 'cheap' it is to fight spam and abuse simply by restricting accounts attested by [apple,google,microsoft] and nobody else, specially 'None' like this one. When you talk about webAuthn that is what you are talking about in the end. 3rd party attestation. Which in the end will be the end all "privacy respecting" (/s) advertisement profiling tech in the years to come.
- prhrb 4y agoCan someone explain more?
- thealchemistdev 4y ago[flagged]
- lima 4y agoBeautiful example of the limits of AI - it simply reiterates the comment in a seemingly informative way, but it doesn't actually understand it, so it really just states the same thing but more verbosely. Knowing nothing about Passkeys, it's also subtly wrong. What exactly is your point?
- misnome 4y agoNot just verbosely, but with the implied contempt!
- namaria 4y agoIt's a bit anticlimactic how the hype is just dying down and everyone involved is just pretending they weren't just weeks ago crying wolf about the whole thing. Still I feel vindicated in my early assessment that it was mostly just empty hype about some chatbot.
- deleted 4y ago[deleted]
- pmoriarty 4y agoCan anyone explain in a simple, practical way how you would actually use this?
- vrglvrglvrgl 4y ago[dead]
- AviationAtom 4y agoAm I mistaken, or has the open source community beaten the commercial password managers to implementing WebAuthn?
- 8organicbits 4y agoI'm not sure about other password managers, but this pull request is still open so it's not ready yet.
- fullstop 4y agoBitwarden supports it (for paid accounts) https://bitwarden.com/help/setup-two-step-login-fido/ https://bitwarden.com/help/setup-two-step-login-fido/
- sodality2 4y agoThat's not the same thing. Here, KeePassXC supports being a WebAuthn _device_ for logins, whereas linked is how you can use WebAuthn to log _into_ bitwarden. The former is basically (?) emulating the device, whereas the latter is just supporting it for vault logins
- fullstop 4y agoI understand the difference now. Thanks!
- samcat116 4y ago1Password already has a beta/demo of this I believe.
- piokoch 4y agoKeePassXC is one of those old style applications that are fast, small, does not change UI every quarter and does well what it was built for. It does not offer "cloud integration", does not send email asking you if you are happy with it and if you want to upgrade to Pro Plan that let you share your passwords with your grandma. Or mine cryptocurrency, ok, this crypto is passe now, nowadays, it would be integration with ChatGPT that would invent better passwords for you... You put the file on Google Drive, Drop Box, etc. and now you have simple, "distributed" password manager that works on every reasonable platform.
- admax88qqq 4y agoGoogle drive file conflicts fail silently. Putting your key pass file in drive is setting yourself up to lose credentials if you devices sync up at a bad time. A cloud solution that syncs on a per password basis with end to end encryption offers a more reliable experience.
- NoZebra120vClip 4y agoThat depends on whether you're using synced folders or if you're mounting the Drive as a drive.
- marwis 4y agoEven when mounted (FileStream) uploads are asynchronous and there is no locking
- flangola7 4y agoI thought passkeys are always stored in secure enclaves and can't be exported?
- ezfe 4y agoNo, Passkeys are just some random data and cryptography. However, the most popular implementations (like in iOS/macOS) use TouchID/FaceID/Passcode to protect access to the passkey. That doesn't preclude other implementations from doing it other ways.
- liminal 4y agoI just switched to KeepassXC because KeeWeb is now unmaintained. I really miss the UI simplicity of KeeWeb. Posting this here in case there are any folks reading who are motivated to maintain a Keepass implementation with a far better UX. https://keeweb.info/ https://keeweb.info/
- remram 4y agoThis requires a browser with a passkey-providing plugin right? There is no way to use a passkey without browser support, like there is for password managers (copy/paste, or copy it from your phone screen)?
- proctrap 4y agoI'm just guessing, but KPXC could emulate a USB device, or - if such things exist - register itself as a security key provider with the operating system because using a yubikey instead isn't that much more in terms of key-to-browser pipeline - the browser just requests the key from a providing entity
- SkyMarshal 4y agoI use KeePassXC on my linux desktops and macbook, but are there any good mobile apps that support it, that I can import my database into?
- kioshix 4y agoI use KeePassium on iOS, synced with Dropbox. Works perfectly. Other sync methods are available too.
- shhsshs 4y agoI have been enjoying Strongbox for passwords plus Mobius Sync (a Syncthing implementation) to keep the password file synced. I am on iOS. Mobius Sync can sync a file to iOS’ built in file store, and Strongbox can read that. So they work pretty well as a pair.
- kps 4y agoIs there now a straightforward way (on both platforms) to use KeePassXC in the role of login keyring/keychain? Last time I looked, admittedly not recently, the answer was “we think you shouldn't want this”.
- SkyMarshal 4y agoI don't know, I do everything manually. I remember most of my passwords, but when I forget one I open KeePassXC and copy-paste the pwd into the login. And once every month or so, I'll manually ssh the databases around in a round-robin manner and merge them on every machine. Mainly b/c my pwd database is one thing I don't really want to trust to the cloud, and the manual effort of not doing that isn't too onerous.
- proctrap 4y agoI can also recommend using Syncthing for a cloud-less synchronization between the machines
- flal_ 4y agoKeePassDX on Android