6 ms·

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar;

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members). In addition to this being potentially more secure, another benefit is that I can specify that KeePass open certain sites in a non-default web browser. I prefer not to log into some sites/accounts using my primary web browser, and KeePass helps me to avoid this. If I were to use a solution like LastPass for all my password management, I would need to pause and recall which browser I use to log into a site/account. But with KeePass, I just mindlessly Alt-Tab, Ctrl-F, Ctrl-C, and Ctrl-U.

MetaCosm 13y ago
... this doesn't sound easier, this sounds much more annoying. But each to is own.
- subsection1h 13y ago
  I didn't assert that it was easier, just potentially more secure. Similarly, it's arguably annoying to only access financial accounts (and the email accounts that are associated with the financial accounts) using a dedicated banking computer, but I think that having a banking computer is worth it. Others will disagree.
  - jpgoldberg 13y ago
    [Disclosure: I work for AgileBits, makers of 1Password] One way of characterizing the particular paper is "password managers with browser extensions don't always prevent you from submitting your data to the wrong place." Systems that rely on the user to copy/paste offer no such protections whatsoever (and so, I suppose, can't fail at them.) So I'm curious about what you may mean by "potentially more secure" in this particular respect. Are you concerned that you might come to rely too heavily on the password manager's anti-phishing mechanisms? [Note that I fully acknowledge that there may be other security reasons you may wish to keep your password manager out of browser. 1Password and KeePass have different security architectures, development processes, platform support, etc, with their own advantages and disadvantages. People need to figure out which works best for them.]
    - aclevernickname 13y ago
      Not knowing the passwords, and keeping them in a locked database you copy/paste from creates plausible deniability if in a situation where one is beaten with a $5 wrench. For some people, the risk of disclosure by violence is more a worry than the risk of disclosure by the clipboard.
- gemma 13y ago
  KeePass also makes a global keyboard shortcut available (Ctrl+Alt+A by default) that will complete login fields based on the active window title. (The mechanics of the text entry and the window title matching are all configurable, though the defaults are usually fine.) Not as slick as auto-filling without user interaction, but better than manually searching for each entry every time.
  - xur17 13y ago
    I've been using this in ubuntu (ctrl-alt-v in keepassx). It covers most of the sites I use, and works with minimal extra effort. I originally looked at Lastpass, but it seemed 'too' easy. Decryption is done client side via javascript, but what happens if someone hacks into Lastpass's server, and modifies the code to send the user's entered password to their server?
    - jlgaddis 13y ago
      http://www.pcworld.com/article/227268/lastpass_ceo_exclusive_interview.html http://www.pcworld.com/article/227268/lastpass_ceo_exclusive...
deleted 13y ago
[deleted]
throwaway2048 13y ago
is anyone aware of an smartphone app that allows your phone/tablet to act as a usb keyboard for a pc, and "type" passwords in for you?
- johnchristopher 13y ago
  Bluetooth remote control ?
- serf 13y ago
  what about software hid loggers?
Havoc 13y ago
It loses one key benefit though - phishing sites. When Lastpass doesn't fill something in that I expected it to fill in I eyeball the site very carefully to see wtf is going on.
- pieceofpeace 13y ago
  No, it is actually more secure than Lastpass because the site is opened by KeePass directly (in the browser he specifies).
JelteF 13y ago
Keepass has browser extensions as well. They're quite good and only gives the password to the site you want. https://github.com/pfn/passifox https://github.com/pfn/passifox
- tokenizerrr 13y ago
  Yes, this. There's also one for chrome. You can set it to have the keepass application pop up a yes/no dialog for every requested password so you will be notified whenever the extention requests the password.

MetaCosm 13y ago

... this doesn't sound easier, this sounds much more annoying. But each to is own.

subsection1h 13y ago
I didn't assert that it was easier, just potentially more secure. Similarly, it's arguably annoying to only access financial accounts (and the email accounts that are associated with the financial accounts) using a dedicated banking computer, but I think that having a banking computer is worth it. Others will disagree.
- jpgoldberg 13y ago
  [Disclosure: I work for AgileBits, makers of 1Password] One way of characterizing the particular paper is "password managers with browser extensions don't always prevent you from submitting your data to the wrong place." Systems that rely on the user to copy/paste offer no such protections whatsoever (and so, I suppose, can't fail at them.) So I'm curious about what you may mean by "potentially more secure" in this particular respect. Are you concerned that you might come to rely too heavily on the password manager's anti-phishing mechanisms? [Note that I fully acknowledge that there may be other security reasons you may wish to keep your password manager out of browser. 1Password and KeePass have different security architectures, development processes, platform support, etc, with their own advantages and disadvantages. People need to figure out which works best for them.]
  - aclevernickname 13y ago
    Not knowing the passwords, and keeping them in a locked database you copy/paste from creates plausible deniability if in a situation where one is beaten with a $5 wrench. For some people, the risk of disclosure by violence is more a worry than the risk of disclosure by the clipboard.
gemma 13y ago
KeePass also makes a global keyboard shortcut available (Ctrl+Alt+A by default) that will complete login fields based on the active window title. (The mechanics of the text entry and the window title matching are all configurable, though the defaults are usually fine.) Not as slick as auto-filling without user interaction, but better than manually searching for each entry every time.
- xur17 13y ago
  I've been using this in ubuntu (ctrl-alt-v in keepassx). It covers most of the sites I use, and works with minimal extra effort. I originally looked at Lastpass, but it seemed 'too' easy. Decryption is done client side via javascript, but what happens if someone hacks into Lastpass's server, and modifies the code to send the user's entered password to their server?
  - jlgaddis 13y ago
    http://www.pcworld.com/article/227268/lastpass_ceo_exclusive_interview.html http://www.pcworld.com/article/227268/lastpass_ceo_exclusive...

deleted 13y ago

[deleted]

throwaway2048 13y ago

is anyone aware of an smartphone app that allows your phone/tablet to act as a usb keyboard for a pc, and "type" passwords in for you?

johnchristopher 13y ago
Bluetooth remote control ?
serf 13y ago
what about software hid loggers?

Havoc 13y ago

It loses one key benefit though - phishing sites. When Lastpass doesn't fill something in that I expected it to fill in I eyeball the site very carefully to see wtf is going on.

pieceofpeace 13y ago
No, it is actually more secure than Lastpass because the site is opened by KeePass directly (in the browser he specifies).

JelteF 13y ago

Keepass has browser extensions as well. They're quite good and only gives the password to the site you want. https://github.com/pfn/passifox https://github.com/pfn/passifox

tokenizerrr 13y ago
Yes, this. There's also one for chrome. You can set it to have the keepass application pop up a yes/no dialog for every requested password so you will be notified whenever the extention requests the password.