Hacker News Reader

Comment by liminal | Hacker News Reader

I was just given a mac at work and haven't figured out how to integrate KeePass with Firefox on OSX. On Windows I was using KeeFox, but I can't find a mac client that include KeePassRPC and the mono instructions didn't make sense. For now I'm using KeeWeb and manually copying entries. Suggestions?

View on HN

Suggestion: don't use integration. The whole idea has a high risk of security compromise and the plugins I've seen were not implemented well. I use copy/paste or Autotype and don't find it slow to use at all.

So now all anyone needs to do is watch your clipboard? I'm not arguing your approach as I use Keepass in the same way, but I also know it'd be pretty straightforward to snarf my creds if you were able to watch my clipboard.

Autotype bypasses the clipboard. It works well, particularly for those annoying login pages that prevent pasting from the clipboard.

KeePass can do two-channel obfuscation where it mixes both clipboard and keystrokes, but both of these things are trivial to intercept.

Not exactly - KeePassXC (and many of the other clients) do try to unset the clipboard. I think this is as much to save you from accidentally pasting a password into your browser's search box or a chat, but at least on OSX / macOS, it prevents a malicious script from using pbpaste to grab the last entry off the clipboard.

KeePass does the same thing by default, but all you've done is create a race condition. Clipboard changes can be picked up by any application that cares to listen.

https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-c...

source: https://github.com/smorks/keepasshttp-connector

Reply on news.ycombinator.com