Hacker News Reader

Comment by mettamage | Hacker News Reader

I've heard this one recommended over and over again. Are there any "I wish I knew this beforehand" type of tips?

Also, how would people compare this to something such as 1Password?

> Are there any "I wish I knew this beforehand" type of tips?

Read my comment on the top of the comments. The top features are browser integration, auto-type and integration with Touch ID/fingerprint reader.

> how would people compare this to something such as 1Password?

KeePassXC auto-type is a lot more powerful. It can be configured in several ways and works with a lot more windows: SSH sessions in terminals, os windows in programs, etc.

OTOH, 1Password is automatically "clouded". With KeePassXC you need to place the encrypted database in a cloud (OneDrive, Google Drive, Apple Drive).

I sync the (strongly) encrypted database throughout my devices with Syncthing and it works flawlessly. I have an old laptop with syncthing running always on to avoid sync conflicts.

Interesting, thank you.

Syncthing looks a lot like a "make your own cloud" solution.

I use OwnCloud in a RaspberryPi, instead. But as Moxie Marlinspike famously said: "People don’t want to run their own servers, and never will". (https://moxie.org/2022/01/07/web3-first-impressions.html)

You don't have to "make your own cloud" to use Syncthing : you can just set your phone and your laptop as sharing, and never have to handle a server at any time.

Of course it's not magical : for them to be in sync, you'll then have to have both turned on with Syncthing running at the same time.

But if you have something lying around, like an old laptop, it's trivial to have it running, and maintenance is super low, just keep update it from time to time : I have Syncthing running on a low cost server for multiple years, syncing pictures + documents, and the only issue I ever had was disk space running out once.

The other benefit of manually syncing KeePassXC is that you can require it to use a key file in addition to pass phrase. Then you sync the database using another service but not the key file (copy that to each client locally). I'd your cloud provider is compromised they are missing not only your passphrase for brute forcing (good luck) but also the key file.

I used KeePassXC for many years. As the number of devices on which I need my password manager proliferated I've moved to BitWarden primarily for the built-in database replication. One can certainly replicate KeePassXC db's using any variety of methods, but it becomes a liability on my time to ensure that it is operating properly. KeePassXC is quite a fine and useful bit of software.

The lack of built-in replication is considered by many (me included) as more secure as the db is only on a single system and never in the cloud or on the wire.

Multiple devices is a slight pain, you have to keep everything synchronized yourself, and conflicts mean you can lose passwords in your sync service debris (if you even have that feature).

I switched to Bitwarden in order to deal with this.

Did you try diffing the conflicting databases through a tool like keepass-diff before switching?

I'm the author of keepass-diff and built it for my own needs. Looking through the comments here about why people switched from Keepass to Bitwarden, it feels like the compare feature is something that should be integrated to UI clients as many people seem to face this problem. I always assumed it was more because of permissions and better ability to work with it as a team...

I did not, I wasn't aware of keepass-diff and certainly it would've been able to solve the problem. But to tell you the truth I don't think I would use it. This is something that I really don't want to have to worry about regardless of what device I'm using.

Thanks for the insight! I guess it's a hard problem to solve with these conflicts. I'm wondering how it could be automatically resolved if a user has the same thing open multiple times with changes to the same password...

Reply on news.ycombinator.com