Hacker News Reader

Comment by alexnewman | Hacker News Reader

Why should I switch from pass (git+pgp) to keepassx ?What's one feature in keepassx nto in pass/passx

For me the biggest difference is that you have a single encrypted database file, and that no metadata is stored unencrypted. By default, pass uses file names as keys, so website names are stored in the clear. (To fix this on pass.you need to use pass-tomb, which I found very clunky, and could never get working quite right)

Another thing I like about keepassxc is that it has lots of features. It comes with a flexible passwird generator, has a friendly GUI UI, can be integrated to the web browser using an extension, and there are compatible android apps you can use on your phone.

I agree about the metadata. I like pass but it's a flaw for sure. At least it's upfront about it.

Most other issues are covered with pass, like a good android app etc etc.

You could always use pass-tomb, which is an extension that stores the entire tree encrypted.

https://github.com/roddhjav/pass-tomb#readme

As I mentioned further up, pass tomb needs to be installed separately (which is not trivial depending on your distro) and is clunky to use. AFAIK it also cannot be used to encrypt the password database on Android.

It also really bugs me that an important security feature like this one is not the default.

tomb seems fine on ios and android. I don't use it though

This is a common claim, and besides that fact that tomb fixes it and is supported on all distributions, I'm not convinced it's a problem. What's the threat model? That folder should be 700 anyway? Or is this just paranoia?

but exposes to who?

I am a pass user and for me the big drawback is that is exposes the website names by design.

Reply on news.ycombinator.com