Hacker News Reader

Comment by Jamie9912 | Hacker News Reader

I never understood the appeal of web-based password managers. KeePass all the way, all offline, no randomly changing UI, everything in a single .db file. Need syncing? Use Cloud storage service.

View on HN

> Use Cloud storage service.

It works until you have conflict edits on different device and need merging.

I stick to adding entries on my desktop and distributing copies to my clients. Its better for me to limit syncing between devices.

the appeal is that it's a one click solution that works everywhere. If you have multiple devices, even worse if it's a mix of Android, Iphone, Windows, Mac, Linux you now have to find some cross platform sync solution on every device, the autofill functions of the various plugins don't work half the time, it usually ends up being an annoying mess. And if you need secure credential sharing with family members it's ten times more complicated yet again.

Can it fill passwords in iPhone Safari?

Yes, via the KeePassium client:

https://github.com/keepassium/KeePassium

As with all iOS apps, there’s no guarantee that the open source app code on GitHub corresponds to what you install from the App Store.

I have been very satisfied with KeePassium, it integrates with all the cloud storage providers I’d want and the app itself works well.

Notably though, Keepassium from the App Store is licensed differently than the version on GitHub. Only the Keepassium team can ever actually submit to the App Store as GPL software is banned, and so they do not accept contributions so that they have the ability to submit under a proprietary license.

GPL software isn't banned. Is this just your speculation?

My reading from the License section[1] of the Keepasium README and this Stack Exchange post[2] is that the author of KeePassium wishes to license KeePassium under GPLv3. Accepting applications licensed under GPLv3 would require that Apple provide certain forms of source code alongside App Store downloads which they are unwilling to do. As such the App Store terms of service has terminology stating that you give Apple the right to not do that, which is something that only the copyright holder(s) of a work can do. The simplest way to have clarity over who holds the copyright is to have a single author. So long as the KeePassium author is willing to assign Apple the permission implicit in submitting to the App Store, that’s fine. It just means that all other uses of KeePassium must follow the GPLv3 license.

I am not a lawyer, nor really even well-versed in IP law, and you should not take this as legal advice.

[1] https://github.com/keepassium/KeePassium?tab=readme-ov-file#...

[2] https://opensource.stackexchange.com/questions/9500/is-apple...

Yes, you got it right. The source code is published under the GPL, but App Store ToS impose additional restrictions that are incompatible with the GPL. So we have to dual-license the project, and only the copyright owner can do that. In order to maintain that role, we can only accept contributions with a CLA (two pages of legalese that transfer the copyright). This is obviously a deterrent for contributions: over the 5 years, I believe there were only 3 people who signed it :)

Yes, with integrations like Strongbox

You can do the same with Bitwarden by having the vault in your local computer.

Agreed. Too many places where things can go wrong.

Reply on news.ycombinator.com