11 ms·

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-o

See quite a few nods to 1Password in here, which is good, although I tend to favor KeePass myself, given that it's FOSS. It also has a way better Firefox add-on than any of the others I've seen (which is my main browser), and the Android apps, if unofficial, aren't bad either [0]. Importantly, they feature the ability to either pull from a local Keepass DB or to get it from a connected Google Drive account. I've taken to using the latter to make sure my database is synced across all my devices. At this point it works fairly well across everything I use, with the one exception that trying to keep the database synced on my Windows box requires an extension that looked a tad shady to me [1], so I opted to simply manually upload a new version each time instead. [0]: https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi... [1]: http://keepass.info/plugins.html#kpgsync http://keepass.info/plugins.html#kpgsync

cmdrfred 11y ago
I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.
- tokenizerrr 11y ago
  Which extension do you use for that?
  - AdmiralAsshat 11y ago
    He might be using the IOProtocol Extension: http://keepass.info/plugins.html#ioprotocolext http://keepass.info/plugins.html#ioprotocolext
    - cmdrfred 11y ago
      That's the one.
- fluidcruft 11y ago
  Is there any solution for keepass on ChromeOS (I mean other than the whole developer mode/crouton thing, I prefer to keep ChromeOS in secure mode)?
  - AdmiralAsshat 11y ago
    For my Chromebook, I use a chrome app called Browsepass. It's still pretty rough, but it at least lets me open the KeePass database: https://chrome.google.com/webstore/detail/browsepass/pihdapfeofbodahcblfmeckjnfcigakb?hl=en https://chrome.google.com/webstore/detail/browsepass/pihdapf...
bgray 11y ago
So you're trusting Google?
- AdmiralAsshat 11y ago
  The KeePass database itself is encrypted with a Master Password/Password Phrase. You can take a look at the encryption they use for it here: http://keepass.info/help/base/security.html#secencrypt http://keepass.info/help/base/security.html#secencrypt Hence, I am reasonably confident that even if Google were to turn over my Drive account to the NSA, they wouldn't be able to crack open the database. See also: discussion on feasibility of brute forcing a KeePass database: https://security.stackexchange.com/questions/8476/how-difficult-to-crack-keepass-master-password https://security.stackexchange.com/questions/8476/how-diffic...
  - sjwright 11y ago
    That's no different to how LastPass stores your vault on its servers, isn't it? They're just using their own cloud instead of Google's.
    - matwood 11y ago
      When thinking about security who has more resources and expertise? LastPass or Google?
      - DoubleMalt 11y ago
        It depends on your threat model. If you are more afraid of the government than of a random script kiddie, the vastly bigger resources of Google do not matter as your (encrypted) database is just a NSL away. And then the NSA is trying to crack it </tinfoil hat mode>
        matwood 11y ago
        Well if I put on my tinfoil hat, then there is no protection from the NSA. So, now I'm only trying to protect my password/identity from criminal elements, I tend to side with Google as knowing what they are doing. It doesn't mean they will also be mistake free, but it is something they deal with and have been dealing with before LastPass was even an idea.
rwhitman 11y ago
I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability
- dragontamer 11y ago
  If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.
  - tiglionabbit 11y ago
    I like this idea. I think I'll try this out for all those random dumb websites that want passwords. You linked to the old version btw. Updated version is here: http://angel.net/~nic/passwdlet.domain.html http://angel.net/~nic/passwdlet.domain.html
  - StavrosK 11y ago
    There are multiple problems with this approach. SHA is way too fast, some site is always going to have Auth requirements that won't be the same as the ones you have set (one service wants mandatory special characters, one wants mandatory alphanumeric only), and, most importantly, you can't change the passwords unless you change the master password and remember which you used where.
    - dragontamer 11y ago
      Fair point. But proper key strengthening is a well-known solution to this well-known problem. The general methodology of using password-safe hash + master password + domain name is useful. As you note, SHA isn't appropriate for this purpose. PBKDF2-strenghtened SHA, SCrypt, BCrypt and other functions should be used.

cmdrfred 11y ago

I have a sftp account on my server for my keepass data, I can sync it from anywhere and I don't have to worry about google drive having access to my (encrypted) data. I like it.

tokenizerrr 11y ago
Which extension do you use for that?
- AdmiralAsshat 11y ago
  He might be using the IOProtocol Extension: http://keepass.info/plugins.html#ioprotocolext http://keepass.info/plugins.html#ioprotocolext
  - cmdrfred 11y ago
    That's the one.
fluidcruft 11y ago
Is there any solution for keepass on ChromeOS (I mean other than the whole developer mode/crouton thing, I prefer to keep ChromeOS in secure mode)?
- AdmiralAsshat 11y ago
  For my Chromebook, I use a chrome app called Browsepass. It's still pretty rough, but it at least lets me open the KeePass database: https://chrome.google.com/webstore/detail/browsepass/pihdapfeofbodahcblfmeckjnfcigakb?hl=en https://chrome.google.com/webstore/detail/browsepass/pihdapf...

bgray 11y ago

So you're trusting Google?

AdmiralAsshat 11y ago
The KeePass database itself is encrypted with a Master Password/Password Phrase. You can take a look at the encryption they use for it here: http://keepass.info/help/base/security.html#secencrypt http://keepass.info/help/base/security.html#secencrypt Hence, I am reasonably confident that even if Google were to turn over my Drive account to the NSA, they wouldn't be able to crack open the database. See also: discussion on feasibility of brute forcing a KeePass database: https://security.stackexchange.com/questions/8476/how-difficult-to-crack-keepass-master-password https://security.stackexchange.com/questions/8476/how-diffic...
- sjwright 11y ago
  That's no different to how LastPass stores your vault on its servers, isn't it? They're just using their own cloud instead of Google's.
  - matwood 11y ago
    When thinking about security who has more resources and expertise? LastPass or Google?
    - DoubleMalt 11y ago
      It depends on your threat model. If you are more afraid of the government than of a random script kiddie, the vastly bigger resources of Google do not matter as your (encrypted) database is just a NSL away. And then the NSA is trying to crack it </tinfoil hat mode>
      - matwood 11y ago
        Well if I put on my tinfoil hat, then there is no protection from the NSA. So, now I'm only trying to protect my password/identity from criminal elements, I tend to side with Google as knowing what they are doing. It doesn't mean they will also be mistake free, but it is something they deal with and have been dealing with before LastPass was even an idea.

rwhitman 11y ago

I don't understand why 1Password's approach to the cloud - syncing via Dropbox or Google Drive - is considered that much more secure than LastPass. If anything relying on Dropbox has always seemed to me to be a huge liability

dragontamer 11y ago
If you wanted security, you'd use a SHA256 hash of a master-password + domain name. http://angel.net/~nic/passwdlet.html http://angel.net/~nic/passwdlet.html Storage is unnecessary. LastPass, 1Password... every one of them has centralized storage. No one needs a central server, but a central server is the only way a "service" can sell itself.
- tiglionabbit 11y ago
  I like this idea. I think I'll try this out for all those random dumb websites that want passwords. You linked to the old version btw. Updated version is here: http://angel.net/~nic/passwdlet.domain.html http://angel.net/~nic/passwdlet.domain.html
- StavrosK 11y ago
  There are multiple problems with this approach. SHA is way too fast, some site is always going to have Auth requirements that won't be the same as the ones you have set (one service wants mandatory special characters, one wants mandatory alphanumeric only), and, most importantly, you can't change the passwords unless you change the master password and remember which you used where.
  - dragontamer 11y ago
    Fair point. But proper key strengthening is a well-known solution to this well-known problem. The general methodology of using password-safe hash + master password + domain name is useful. As you note, SHA isn't appropriate for this purpose. PBKDF2-strenghtened SHA, SCrypt, BCrypt and other functions should be used.