Hacker News Reader

Comment by kemayo | Hacker News Reader

In a way this is a nice example of why 1Password or BitWarden are doing well. This might work out okay for a technical person, but the average user isn't going to look at the KeyPass downloads page [1] and feel confident about what to download -- even assuming they're using Windows, you need a phone app and sync for meaningful password management these days... and that's very worrying in their presentation. Whereas 1Password and similar do just tell you "download this everywhere, it'll do what you need".

[1]: https://keepass.info/download.html

View on HN

At least KeePassXC has a non-cryptic website. Still not as convenient as the cloud based ones though, but it's nice if you are primarily using one device or know how to share the database between your devices.

KeePassXC is overall a much better experience. Even the website is significantly less intimidating-looking.

Plus I feel that once one has experienced the browser integration of 1Pass, BW, LastPass, etc it's hard to go back to manually filling credentials again. That and the seamless sync across devices. It's just too much to handle for non techie folk.

I'm willing to tolerate a little friction to setup syncing, but keepass has friction at almost every level.

Their importer is powerful... but I had to manually configure it to import from lastpass. Just bake that in ffs.

There is no "generate password" button on the main application screen despite that being the #2 use for a password manager behind autofilling. Instead the main screen has "find", "find entries" and "search" buttons which are all slightly different despite sounding completely redundant.

To get a browser plugin, you have to pick from a disturbingly long list, each with pros and cons, each requiring a few config steps, and none of which work as well as the cloud competition. I had random disconnections from keepass and many autofill failures.

Finally, you get to syncing, and the friction is bigger than you expect. It is not enough to set up a LAN folder; your solution needs to be able to resolve conflicts if you ever use more than one device simultaneously, otherwise you run the risk of losing changes. The most common sync solution is dropbox because that is the only mainstream cloud offering with first party support for linux, which is fine, but can still cause conflicts. The recommended way to handle this is quite convoluted[1]. Just bake that in, FFS!

[1] https://keepass.info/help/kb/trigger_examples.html#dbsync

This is the “disturbingly long list” of plugins that the commenter is likely referring to: https://keepass.info/plugins.html

Some plugins on the list require other plugins to also be installed.

>Finally, you get to syncing, and the friction is bigger than you expect. It is not enough to set up a LAN folder; your solution needs to be able to resolve conflicts if you ever use more than one device simultaneously, otherwise you run the risk of losing changes.

Would you explain what kind of a problem you see here (I mean: KeePass related)? AFAIK syncing two KeePass database instances is based on timestamps, so losing changes made on any two copies kept/used on different devices is simply impossible if you properly use KeePass (ie. do merge them with KeePass). Of course, if you want to have a real cloud-based password manager then KeePass (without any extension) isn't appropriate at all. But what's the purpose of comparing apples to oranges?

> phone app and sync for meaningful password management these days

Idk. I very intentionally decided to not have 98% of my passwords on my phone. (The remaining few rarely change and I put them in my phone by hand without sync.)

This decision was less because of security consider but more because I don't want to be able to access the services through my phone.

If then anyone (especially I myself) wants to pressure me into doing work or anything like that when I'm away it won't work because I simply can't. Makes it easier to switch off after work or on holidays.

I have all my passwords on my phone too (bitwarden)

But work gets its own separate password manager that only lives on the work computer and nowhere else. I’ll get fired before I even think about work outside of work hours let alone on vacation.

work in my comment also refered to e.g. student work and similar :-)

the company I'm now working for uses 1password, it's on my work laptop and only there, not on my phone, neither my private PC. Same for slack. Only office mail is also on my phone, so that I can call sick from my phone if necessary (but normal work communication doesn't go through mail at all, so it's fine).

I don't find that doing work when only my phone is accessible is a problem (though I'm sure that varies wildly based on your job / workplace-culture). However, I do find that most of the passwords I have saved are random app-services / websites for personal use, and I'd prefer to have them available if I need them -- even if all I'm saving myself is the effort of getting up and walking over to my computer.

I am not sure what you are looking at, but when I go to the 1password page from my mobile I see big buttons with: memberships, families, business and team, Mac, Windows, Linux, IOS, apple watch, android, 1password in the browser, scim Bridge, cli, secrets automation, ssh, desktop betas, browsers,android betas, IOS betas, previous versions.

Now that is a whole different level of confusing then keepass. I mean I generally know what I'm looking for, but wouldn't know if I should click on the families or Linux button for example. So I think this refutes your point that market share is due to the download page.

I'm really not sure what you're looking at, but on 1Password's mobile site there's a huge button to download from your phone's store on the homepage. The "Try 1Password FREE" button takes you to a well laid-out pricing page.

Edit: Ah, I guess you might be talking about the small Downloads section in the footer. Even that's much more clear than a page with a 2.x download, 2.x portable download, 1.x download, 1.x portable download, and then 30+ unofficial ports.

I replied in a different comment that I landed on the community page.

But I have to say, arguing that the downloads buttons on keepass are more friction than "get started" (I don't see a app store link) which takes me to the business offer and then the family offer where I have to register an account and provide payment details, is a bit of a stretch. And bitwarden is very similar.

Sure I can search on the playstore, but then I also find keepass quite easily there.

I think that's just the downside of 1Password/Bitwarden's business model. The best they can do is explain the core features on the splash page, as you'd need a valid account to actually use the app in the first place.

KeePassXC is probably the closest to ideal. It could just use more info about what it does on the homepage, and change its name for better marketing. But the project states itself that their audience is "for people with extremely high demands of secure personal data management" so I doubt that would ever be addressed.

>KeePassXC is probably the closest to ideal.

Well, "the closest", but not ideal, unfortunately, what I realized when they decided to abandon support for windows7 forcing me to maintain the KeePass database in VMs by hand... :-(

Replying to myself, seems like I went to 1password.community which is the first result I get when I search. I guess this goes to show for the perils of having to be high in the search rankings.

and reliably managing a secure backup is too much to ask of my mom and some others. I am pretty technical, self host, and manage backups, but I have lost data in situations due to failed disks and DB corruption. Losing one's password vault can be almost catastrophic. I am not knocking KeepassXC, but I just can't recommend it for some users.

Reply on news.ycombinator.com