Comment by bad_user | Hacker News Reader

Comment by bad_user | Hacker News Reader

Parent Full thread

In another comment I mentioned these 3 KeePass ports:

[1] https://keeweb.info/

[2] http://keepass2android.codeplex.com/

[3] https://minikeepass.github.io/

I'm a former 1Password user and these work fine. The Android app is actually better than 1Password, and KeeWeb is better for me because it works on Linux as well and it gives me a full history of all edits (not just the password field). Plus being just one file, it is also easier to go back in time using Dropbox's version history.

What you'll miss is the fancy browser extension, but for me that's fine, because a browser extension represents a huge security risk, and selecting a field in KeeWeb is painless as it has keyboard shortcuts. 1Password also has the capability for local network Wifi sync, which is really cool, but at least in my opinion they are moving away from this model and that feature will be gone.

So you'd rather copy and paste passwords because KeePass doesn't have browser extensions? No, thanks. How are extensions security risks? You still need to enter your master password to decrypt passwords. And extensions are siloed by the browser.

For example, Lastpass recently had an exploit in their extension: https://news.ycombinator.com/item?id=12171547

I see nothing wrong with copy/paste. On Android it is a security risk, because apps can get notified and wake up when it happens, but Keepass2Android that I mentioned provides a keyboard for input which works better than 1Password.

And on desktops, I just don't think it's a real threat. Bruce Schneider doesn't thinks so either, while at the same time he recommends against auto-fill: https://www.schneier.com/blog/archives/2014/09/security_of_p...

But even so, KeeWeb and KeePass give you this "auto-type" facility that types the password for you in any password field, without going through copy/paste. It's not much, but it works if you're worried.

There are browser extensions that interface with KeePass to do what you are asking.

I don't use them, I simply use KeePass' autotype feature.

I'd like to see websites make copy/paste easier by allowing you to enter user name and password in a combined field. Have separate fields that can be used the normal way, but also allow submission with the username field left blank and the password field containing username:password.

The fancy browser extensions are important in protecting you from phishing. They will refuse to fill in your password unless the domain matches exactly.

Reply on news.ycombinator.com