I use KeepassX on my desktop PC and have been looking for an iOS app that can open the database. I found one but it occurred to me that I have no idea who wrote it or whether they can be trusted with my passwords. And iOS offers no way to prevent an app using the internet, so I couldn't be sure it wasn't leaking my passwords back to HQ - unlike on the (Linux) desktop where I can run it in an environment that I control (relatively speaking - no need to point out that I haven't personally audited the kernel).
Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers?
From the text it looks like one of the selling points is integration with apps like browsers so you don't have to copy/paste passwords, as with KeePassX.
Personally, to me that sort of integration has always seemed like a bad idea. I'm glad that my password database can't talk to my browser programmatically. One less thing to go wrong.
Here is the repository which isn't linked anywhere on the site: https://github.com/keepassxreboot/keepassxc
I haven't tried it yet, but maybe this will address some of my pet peeves. My primary peeve is that, in keepassx, there is no fantastic way to handle password changes. I can generate a new password, but the only way to get it into a webpage without overriding the old password in the database is to show it on the screen and then copy the visible text.
(My second peeve is that the "type the password" feature types the username and password, making it useless for the more annoying disabled-paste password prompts.)
While we're at it, is there any open source self-hosted alternative to LastPass etc.?
At this point we'd even go so far as just using a good Keepass Client that comes with a comfortable "send encrypted password blob to xy email, than call him and tell him this decryption password"-function.
I tried to stick with KeePass.x for the longest time, but keeping the keepass databases in sync across multiple platforms/devices, while possible, was very much a pain and quite a clunky/messy process which always required me to remember to do something after updating the database anywhere. I eventually gave up and migrated to Lastpass which "Just Worksâ„¢" on all my devices.
Honestly, as a programmer/ops knowing git and always having a terminal somewhere around, I see no reason to use something else than https://git.zx2c4.com/password-store
It uses a git repo as storage, gpg encrypts passwords, provides perfect completion and there is an android app. Everything is dead simple and open source.
I previously used KeePassX, which was great due to the multiplatform support. However the project seemed stalled, and I've since switched to the excellent KeeWeb; it's Electron based and is in general more modern.
Why not change the name entirely, then? KeepassX is already a terrible one.
Makes me think of DOS software from 1998.
What are the benefits of using a "real" password manager, such as this one, compared to a plain encrypted file in vim? I thought that benefit was syncing across devices but it turns out the http feature of keepass wasn't implemented in all clients.
How well specified is the kdbx format? Is there a console client? Is the code readable? Keepass seems to have spawned an entire ecosystem of tools and clients, so I'm curious which of these tools are actualy usable.
Bruce Scheneier designed Password Safe: https://pwsafe.org/
It's not one multiplatform app, but there's an equivalent format app on every platform.
ASnyone know why there's no Windows version yet? I'd like to know how this compares to the original .Net KeePass.
Awesome! I am a heavy user of KeePass, and I also use all three main operating systems regularly, so this has always been an annoying issue to have. I usually get around it by using KeePass2Android on my phone and typing out passwords by hand on the other device. Could be worse.
I hope developing an official Android and iOS app is on the list. There are third party alternatives (such as the one I just mentioned), but if the goal is to be completely cross-platform then let's push those out too.
There's one thing I worry about with keeping all my passwords in a single file - if a government agent gains access to it, I'll have to decrypt it, which will reveal the password to my key, my key, and a full list to all web sites I have accounts at and a list of those accounts. Let's say you have an alt reddit account you use to post to /r/ihatedonaldtrump, congratulations, now the government knows with certainty that it was you. It's one thing to see your IP making requests to reddit.com - you can just give them your normal username and password, but with a single password file, you give them all your usernames and passwords. Maybe I'm overly paranoid, but I don't like keeping passwords to anything that might be remotely questionable in a normal encrypted password file.
On the flip side, if the file in question contains an account to a questionable site, could you withhold the key/password to it under the clause against self-incrimination? I.e. you're sued for insulting Donald J. Trump's itty bitty tiny handsy-wandsies, but you also have an account at buymarijuanaonline.com, so you can't give them access to your password database, because you'll incriminate yourself in a different crime.
Does it support the new kdbx4 format which is using Argon2 instead of a custom AES-based KDF?
Why should I move from KeePass2 to this? Prettier GUI under Linux?
With my latest password overhaul I switched to the master password system, not requiring any compromisable database of passwords as with password managers:
You can even implement the algorithm yourself if you don't trust the app (which does not require any permissions on Android).
Anyone knows how this compares to KeePass (without any X suffixes)? (apart from that it has no binaries from Windows apparantly)
The reasons for the fork are explained in details there: https://github.com/keepassxreboot/keepassxc/issues/43#issuec...
It is rather worrying that they mention "keypasshttp" as being one of the pull request which was never merged, although it is all about functionality and not security, just to point out a few months after in another issue that users should stop using this plugin because of a vulnerability: https://github.com/keepassxreboot/keepassxc/issues/147#issue...
I don't really know how secure KeepassX is, but this fork doesn't look like it is any more secure, at least for the time being.
I've been using Codebook (formerly known as STRIP) because it is partly open sourced, however they do not offer a desktop client for Linux and they only sync with commercial cloud services, so I'm looking for an alternative. Is there an overview that compares the various password managers out there?
I've been wondering is there any disadvantage in using password hashers (either as plugins like [0] or standalone) for generating safe passwords? It seems like a great idea to me, yet most people here seems to be prefer full blown PW manager apps or even online services for this. Am I missing something?
[0] https://chrome.google.com/webstore/detail/password-hasher-pl...
What happened to the Windows binaries?
Is there a password manager that can sync to WebDAV?
Even if the data is encrypted, by using 3rd party services such as DropBox you risk someone trying to crack your passphrase without you noticing.
I've been using Keepass Desktop which apparently isn't available for download anymore but it was much better than keepassx
https://github.com/PixelPaws/KeePass-Desktop https://www.pixel-paws.de/en/
The FAQ should explain the reason for the fork. I couldn't find anything about that, and that was the first question I had.
Looks like someone was willing to spend some time on an audit of the original KeePass:
https://www.ghacks.net/2016/11/22/keepass-audit-no-critical-...
I've been using Keeweb for the last year or so and I'm very happy with it. The mobile experience is a little subpar but it works fine in a pinch, and the integrated syncing with your own storage services is handy.
> Binary package for OS X >= 10.7
But I get:
> You have OS X 10.11.6. The application requires OS X 10.12 or later.
??
Edit: Looks like this is a known issue[1].
Finally! Very excited for an improved solution. It would be nice to have something like this on iOS and Android too, but at least my Mac and Windows computers will be able to play nice.
Compiles and installs without trouble on FreeBSD 11.0. Great :D
on Ubuntu, "snap install keepassxc"
I guess I can finally upgrade to the kdbx (v2) format. I had to use kdb because there was no good kdbx editor for OSX.
Does this incorporate enough changes compared to KeePassX to warrant an audit?
Is there any enhancements in UI? I dont find any screenshot posted in the repo
How is the database stability of this program?
The last password program I used had often, very often a corrupted database.
Cross-platform and no Android, interesting.
If you were curious like I was, about why this fork was necessary, I found this on their About page:
KeePassXC is a community fork of KeePassX which aims to incorporate stalled pull requests, features, and bug fixes that have never made it into the main KeePassX repository.