Hacker News Reader

Comment by greggarious | Hacker News Reader

I've been using KeepassXC (KeePass w/ macOS GUI elements) and enjoying it. It's a little simple (you just copy and paste the PW). It doesn't do fancy autofill but there's support for pretty much every OS.

(I use Spideroak to sync the DB across devices)

View on HN

KeepassXC does have a browser extension for Firefox & Chrome.

I use Syncthing to sync it among devices, it's open source and fairly simple to use(compared to other DIY cloud apps)

> KeepassXC does have a browser extension for Firefox & Chrome.

Yeah, but IIRC it doesn't on iOS? I dunno, it hasn't been a big pain point.

My solution has to use the Firefox password manager for low value things (like Hacker News), and manually c/p for the higher value (bank, retirement account, etc).

(Maybe I'm overly paranoid but I don't like to put high value passwords into the cloud)

Guys, why not Keychain, the default password manager of macOS?

iCloud Keychain is Safari-only.

Not any more. I can access keychain passwords in Chrome on iOS.

It's Safari-only on macOS, as far as I know. It does work with iOS apps and it doesn't work on Windows. It can't replace a password manager unless you use Safari on macOS as your primary browser.

Ah, I see why it’s useful for me: I use Chrome and Chrome stores passwords per profile. And I have several profiles that must not be shared (private, work-dev, work-sysadmin...), and an OS-wide password manager would be super-prone to mistakes. I also use Firefox for non-Google-approved work (ex: MRA and James Damore), and, same, profiles work super-well.

I'm not sure, in that case, you're using Keychain at all.

On macOS, Keychain Access.app (built in) can be used as a stand-alone app to generate and store passwords.

WFIW I’m using a plain text file in an encrypted disk image, because I started before I found out about Keychain Access.app, and I never actually trusted third party apps for security reasons and possibly paranoia, so I can’t compare UX quality, but it is available in a form on the desktop.

The purpose of a password manager is some kind of multi-device password sharing. Plain macOS keychain doesn't do that at all. There are certainly ways to manually emulate parts of the behaviour of a password manager, whether it's with Keychain Access or post its in your wallet (or various combinations thereof). Password managers are about automating all that.

It is multi device though. Sure it’s Apple only, but it’s all my Apple devices, macOS and iOS (I don’t have a watch or a TV), not just wherever the password was created.

It's not. Keychain is not synced across devices. iCloud keychain, a separate service, can sync parts of keychain.

iCloud keychain is a perfectly reasonable (and as a UI, probably better than anything else) password manager iff you use Safari as your main browser and all your other devices are Apple devices.

OK, that’s something I didn’t know, and I may be missing something from such a silly name overlap. However, I do have items in Keychain Access.app which are from iCloud. What gives?

Keychain Access lets you view your local keychain (i.e. your device's secure trust store). If you have iCloud keychain turned on then certain parts of your keychain will be synced across devices so you'll be able to find, say, a web password you generated on your phone on in your Mac's keychain (via Keychain Access and otherwise). The terminology is a bit confusing, that much is true.

If you can live within the constraints of iCloud keychain (the Safari/Apple devices thing, don't need stuff like 'team sharing, etc) it's arguably a better solution than 1Password.

Because it's crossplatform. I can open the kdbx file on ios, mac, win and linux. Probably elsewhere too, but these are the ones I use.

> Guys, why not Keychain, the default password manager of macOS?

Because keepass files are cross platform. macOS, iOS, android and all the flavors of Linux support it.

I also strongly prefer having a locally stored password DB on the device rather than letting it sit in the cloud. (Even though I have an admittedly strong passphrase)

Yeah, I use the very old KeepassX 0.9.x because dev jumped the shark after that. I should have a look at XC. Ty.

My setup uses iCloud, Box and Google Drive to sync the kdb.

Reply on news.ycombinator.com