6 ms·

What password manager would you recommend for Linux? I use KeePassX but I wish I didn't have to copy-paste passwords onto website login forms.

edanm 14y ago
I'm wondering this also, only on OSX. I love Keepass on Windows, but the lack of auto-type on OSX is killing me. Bonus points for something which makes having a central repo of shared passwords possible, Keepass is terrible for this.
- alexjeffrey 14y ago
  I'm working on something like this at the moment, which will be released within the next few months. I can email you when it's ready if you're interested?
  - edanm 14y ago
    Sure, but to be completely honest, this is one of those things where I'm very unlikely to take a big chance on a new, untried software. At least, not for my business. For my personal use, sure. I'd like to see a helluva lot of proof that you're a legit company before trusting you with this kind of information. I say this not to discourage you, but just to explain how a business owner will think about your premise. Or at least me, don't know if this is representative of your actual audience or not. In any case let me know when it's up, I'd love to take a look!
    - alexjeffrey 14y ago
      Of course, and these are problems I will be working to solve very early on. The kind of users I'm aiming for should be rightly concerned about the security of their passwords and I will be providing as many mechanisms as possible, both socially and technologically, to prove said security in a transparent way.
InAnEmergency 14y ago
LastPass?
- kirubakaran 14y ago
  I find it hard to trust a closed source app with all my passwords. Also: https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details https://grepular.com/LastPass_Vulnerability_Exposes_Account_...
martinced 14y ago
None. Zero. Zilch. Nada. Will people never learn? Do you realize what happens when your password manager itself gets compromised? Using a password manager is trading security for conveniency. This is simply not acceptable. I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this. The problem, however, is that you can't argue with facts. And the fact is that trading security for conveniency is a very stupid thing to do.
- smilliken 14y ago
  What would you recommend instead? If you insist people remember all of their passwords in their head, you'll end up with them using the same password for everything.
  - purephase 14y ago
    I think the most common is you have a single password, but you hash it with the name of the service you're logging into. For example, if you're password is "puppy" and you're signing-up for HN, your password would be: pHuApCpKy And, if you wanted to make it stronger, salt it with some special characters. p~Hu!Ap@Cp#Ky$ ... which is just the shift-characters on a number row in order. This way, you only have to remember one password, and it is service specific, and pretty strong. No password manager needed. Of course, I don't do this. I use a 1Password and KeepassX.
    - GhotiFish 14y ago
      I like the idea of hashing off a root word + site. I'd rather have the browser do it for me though, and I don't think there's anything on the page itself that I could depend on to hash with. Maybe the domain? To be honest, firefox has an encrypted database of site-passwords. What's wrong with that?
      - icebraining 14y ago
        I have a system like that, that takes a master and the domain. The advantages over the Firefox password manager is availability and not having to worry about backups. Since I know the algorithm, I can recreate any password using widely available tools.
narcissus 14y ago
I think Keepass2 requires Mono but if you're OK with installing that, then xdotools can be installed to autotype for you.

edanm 14y ago

I'm wondering this also, only on OSX. I love Keepass on Windows, but the lack of auto-type on OSX is killing me. Bonus points for something which makes having a central repo of shared passwords possible, Keepass is terrible for this.

alexjeffrey 14y ago
I'm working on something like this at the moment, which will be released within the next few months. I can email you when it's ready if you're interested?
- edanm 14y ago
  Sure, but to be completely honest, this is one of those things where I'm very unlikely to take a big chance on a new, untried software. At least, not for my business. For my personal use, sure. I'd like to see a helluva lot of proof that you're a legit company before trusting you with this kind of information. I say this not to discourage you, but just to explain how a business owner will think about your premise. Or at least me, don't know if this is representative of your actual audience or not. In any case let me know when it's up, I'd love to take a look!
  - alexjeffrey 14y ago
    Of course, and these are problems I will be working to solve very early on. The kind of users I'm aiming for should be rightly concerned about the security of their passwords and I will be providing as many mechanisms as possible, both socially and technologically, to prove said security in a transparent way.

InAnEmergency 14y ago

LastPass?

kirubakaran 14y ago
I find it hard to trust a closed source app with all my passwords. Also: https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details https://grepular.com/LastPass_Vulnerability_Exposes_Account_...

martinced 14y ago

None. Zero. Zilch. Nada. Will people never learn? Do you realize what happens when your password manager itself gets compromised? Using a password manager is trading security for conveniency. This is simply not acceptable. I fully expect all the people using insecure security practice and all the people selling snake oil to downvote this. The problem, however, is that you can't argue with facts. And the fact is that trading security for conveniency is a very stupid thing to do.

smilliken 14y ago
What would you recommend instead? If you insist people remember all of their passwords in their head, you'll end up with them using the same password for everything.
- purephase 14y ago
  I think the most common is you have a single password, but you hash it with the name of the service you're logging into. For example, if you're password is "puppy" and you're signing-up for HN, your password would be: pHuApCpKy And, if you wanted to make it stronger, salt it with some special characters. p~Hu!Ap@Cp#Ky$ ... which is just the shift-characters on a number row in order. This way, you only have to remember one password, and it is service specific, and pretty strong. No password manager needed. Of course, I don't do this. I use a 1Password and KeepassX.
  - GhotiFish 14y ago
    I like the idea of hashing off a root word + site. I'd rather have the browser do it for me though, and I don't think there's anything on the page itself that I could depend on to hash with. Maybe the domain? To be honest, firefox has an encrypted database of site-passwords. What's wrong with that?
    - icebraining 14y ago
      I have a system like that, that takes a master and the domain. The advantages over the Firefox password manager is availability and not having to worry about backups. Since I know the algorithm, I can recreate any password using widely available tools.

narcissus 14y ago

I think Keepass2 requires Mono but if you're OK with installing that, then xdotools can be installed to autotype for you.