Hacker News Reader

Comment by jl6 | Hacker News Reader

I use KeepassX on my desktop PC and have been looking for an iOS app that can open the database. I found one but it occurred to me that I have no idea who wrote it or whether they can be trusted with my passwords. And iOS offers no way to prevent an app using the internet, so I couldn't be sure it wasn't leaking my passwords back to HQ - unlike on the (Linux) desktop where I can run it in an environment that I control (relatively speaking - no need to point out that I haven't personally audited the kernel).

Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers?

View on HN

> Am I being overly paranoid? How should I be approaching the issue of trusting the developers of password managers?

Hmm. Maybe? The trouble is at some point you have to trust someone and there isn't a good way to measure this. Even if the source of the iOS app was open (I don't know if it is, just a hypothetical) there is no guarantee that the source you looked at is the same that was used to compile the binary itself.

I use one for iOS. I sure hope it's trustworthy. But if it isn't...well I don't really know where to turn to. LastPass? I tried them before but was amazing at how awful the UX was and I was too paranoid that someone would eventually find a flaw, get in and expose everyone's passwords ever because it's a cloud service...I am likely too paranoid.

I've been complaining about the LastPass UX for years. Just in the past month I've noticed them start to quietly roll out improvements - one feature at a time. Gives me hope that in a few months the situation will be completely different. As for the trust thing, yeah... I don't even trust myself.

I use MiniKeePass (https://github.com/MiniKeePass/MiniKeePass) on iOS and keepassx2 on Linux. Works fine.

I can attest to MiniKeePass's quality. I've been using it for years now.

I upload my keepass and key file to Dropbox (I know, I know) and then export them to MiniKeePass from the Dropbox app. MiniKeepass auto-associates the key file with the kdbx if it has the same filename as the kdbx, but with a .key extension. I can even edit the DB with Minikeepass and upload it back to Dropbox. It's not as sexy as an Android setup, but it works quite well for me.

This is my exact setup too. Perfectly happy with it. I do wish the iOS app could load my db file each time I start it but I also understand the reasons it can't so I'm ok with it.

I use the old KeePassX on Windows, Linux, and Mac. I use KeePassDroid on Android. The password database is shared via Dropbox. Works fine.

The new fork is intriguing. Need to take a closer look.

I use this too, but I think the question was more about trust than works.

> And iOS offers no way to prevent an app using the internet

You can disable an app's ability to connect via mobile data in Settings, though that doesn't solve the issue for using the app + wifi.

On iOS 10 you can disable either or both cellular and Wi-Fi access for selected apps.

How can this be set in iOS 10? I can only find the option to disable cellular for apps.

I am not seeing that option. Where is it located?

On a related note. On Android "android.permission.INTERNET" is a normal permission and is automatically granted without prompting the user. However, it's explicitly included in an APK's manifest (use-permission) and Google's tools inject this automatically on your behalf.

Does anyone know what happens if you remove the permission from an APK's manifest with apktool etc?

For piece of mind it'd be nice to disable Internet access for certain apps.

EDIT: I know there are solutions when rooted, and also virtual VPN solutions when not rooted. However, in the latter case you have to trust the VPN with all your traffic.

Your answer probably lies in this no-internet version of a popular keepass app for android: https://play.google.com/store/apps/details?id=keepass2androi...

I use a small paper notebook to store my passwords. That I can trust.

If it's ciphered somehow, sure, why not? ;)

But surely the danger feared by most people on computers is not people in their office peeking at their notebook to memorize a password or two? Surely the average person worried about their passwords has in mind the Bulgarian mafia getting all their passwords and ruining their life for some time to come?

In that context, it seems to me, a paper solution is not totally daft.

Storing passwords unencrypted on a piece of handwritten paper in your wallet is exactly what Bruce Schneier recommended few years ago.

Really? I googled to check but only found Password Safe.

The rule of thumb that I apply is to use a very strong, very hard to remember vault password, and to write that down and store it with your taxes or something.

The reasoning being that the thief breaking into your home doesn't care about a random sequence of characters, and how it might allow him to steal your online identity if he boots your computer and finds your vault file.

He cares about the resell value of your camera, iPhone and maybe Macbook.

Edit: I believe OP meant this article:

https://www.schneier.com/blog/archives/2005/06/write_down_yo...

This is the problem my startup is going to solve! It's going to be a service connecting muggers and burglars who steal your physical stuff with criminals who want your passwords! I'm going to call it Robbr!

I used a natty paper notebook for years and in fact I borrowed this method from my mother who seems to feel guilty that she writes this stuff down but I try and reassure her that its ok. In fact I've recently moved away from the notebook for myself because I felt that if somebody breaks into my residence and takes that notebook (not all thieves are ignorant of how valuable a password book is, especially when this contains banking passwords) then all is lost. I'm using the KeePass/dropbox combo with a long passphrase these days though as I've decided that its more secure than the notebook and I can put more explicit information in there (and files), though it is somewhat nerdy so I still recommend the paper notebook for people like my mother.

I am considering that I should store the keepass database somewhere else as a backup but not sure exactly where (at least the file server at my work) and also that I should tell the passphrase to somebody (perhaps an old university friend I don't see often; he does not live nearby or work with me) in case of my untimely demise

When will copy/paste be available via this solution?

A rudimentary version lies between the ears and connects to the fingers.

You're not overly paranoid. I compiled the open-source MiniKeePass iOS client myself. I don't install from the App Store because I can't know what's in those binary bits.

I'm not sure if it will work, but you can give [1] a try. It's as opensource as it gets, works in browser and you can deploy it yourself on your own server.

[1] https://app.keeweb.info/

https://www.keepassx.org/downloads I use the mac client.

[edit]: oops, confused osx and ios. I'm not a mac person.

MiniKeePass but I also like KeePass Touch: built-in Dropbox/cloud sync and fingerprint to unlock the db (payed app, free with a banner otherwise)

MiniKeePass also has TouchID support & will load (not sync) from Dropbox et al.

It's open source, feel free to audit and compile it yourself.

He's questioning the trustworthiness of the unnamed iOS app, not KeePassX

Is there an open source iOS client?

I would love to audit it but I lack both the time and knowledge. How would I verify that what I've audited is the source for the actual binary that the App Store delivers to my phone?

You can't.

Welcome to the walled garden.

You can compile and deploy the app yourself onto your devices with a free developer account. If the one-inch wall around the garden is too high, then maybe the garden isn't a place for you.

A free developer account and a Mac, since only a Mac will run the compiler and the code signer. Inch and a half, maybe, especially as I gather OS X virtualization is much improved since they started giving the OS away free.

Yes, MiniKeePass is open source.

Reply on news.ycombinator.com