3 ms·
Keepass is just a single file, you can share it between devices however you want (google drive, onedrive, dropbox, nextcloud, syncthing, rsync, ftp, etc); as lo
by worble 5mo ago
Keepass is just a single file, you can share it between devices however you want (google drive, onedrive, dropbox, nextcloud, syncthing, rsync, ftp, etc); as long as you can read and write to it, it just works. There are keepass clients for just about everything (keepassxc for desktops, keepass2android or keepassdx for android, keepassium for iphone).
- aborsy 5mo agoHow is the quality of browser extensions compared to Bitwarden?
- worble 5mo agoI don't have any points of comparison since I've never used Bitwarden, but it works well enough for my purposes. It'll match the url, offer to autofill (sometimes those multiflow sites like Microsoft will trip it up, but you can always just right click -> enter username/password for a site and that'll work), and it does TOTP filling too.
- prmoustache 5mo agoYou don't use a browser extension if you are serious about security anyway.
- gck1 5mo agoHow do you autofill from your db then?
- prmoustache 5mo agoI don't autofill. It may be less user friendly but it is not that big of a deal.
- nathanmills 5mo agoI don't save browser cookies for obvious privacy reasons and it's absolutely a big deal to not need to pull up some program and copy paste my login details constantly for every site.
- eipi10_hn 5mo agoI usually just use another profile for the stuff that I clear cookies when closing the profile. The other profiles I just use for a limited of sites that need logging in, each site is in its own container and I don't browse other sites on those profiles. If I ever need to fill the login, I just do any of these: - KeepassXC has auto-type feature, so I just choose the needed one and let it auto-type - I enable the extension only when I need to log in and choose the one I need to fill (not auto-fill, but only fill when I click on the account from the extension pop-up dashboard).
- prmoustache 5mo agoI try to limit my account creation to the minimum. HN is one of the few, for the better or for the worse as sometimes I just think I should nuke it and stop wasting time commenting.
- nextlevelwizard 5mo agoI guess I better just use same password everywhere then…
- TheDong 5mo agoYou do use the browser extension because it's a strong anti-phishing defense. If someone links me to "rnicrosoft.com" with a perfectly cloned login page, my eyes might not notice that it's a phishing link, but my browser extension will refuse to autofill, and that will cause me to notice. Phishing is one of the most common attacks, and also one of the easiest to fall for, so I think using the browser extension is on-net more secure even though it does increase your attack surface some. I know proper 2fa, like webauthn/fido/yubikeys, also solves this (though totp 2fa does not), but a lot of the sites I use do not support a security key. If all my sites supported webauthn, I think avoiding the browser extension would be defensible.
- prmoustache 5mo agoNot having an account for every single damn website + only login from websites you actually entered without following a link goes a long way to avoid that. Sure there may be existence of typosquatting here and there but they tend to be much easier to spot vs the phising url using unicode variants.
- FreePalestine1 5mo agoThat is the problem, syncing isn't the most trivial problem especially for non technical folks. User experience is far superior in a fully managed solution.