Hacker News Reader

Comment by blueskin_ | Hacker News Reader

Should have used KeePass. Even HTTPS isn't perfect, so uploading your data to a third party is a bad idea.

I've heard people say this before, but I'm a little confused by it. Do you only use one device? If not, how do you keep the PWs for your devices in sync without uploading your data somewhere?

Using my local network or USB. Aren't most if not all your devices using your network too? There is no need for your private data to leave your network when you want to sync!

How do you easily connect to your network from your phone?

I enable Wifi and let it login. Takes 3-5 seconds.

...just answered it for me. I scp it across intermittently, as I rarely actually use it on my phone.

Deleted comment

last pass never decrypts or encrypts anything on the server.

Everything is decrypted and encrypted locally. Their website says so and many many security researchers, including me, have verified that...

Have you seen the source?

Have you verified the source you saw is what actually runs?

I understand you actually might have; genuinely interested there. That said, no way I'm going to trust them, especially post-PRISM.

You can recover the source code of all chrome extensions you install....

Lastpass also encrypts data locally before uploading it to their servers. They never get the key used to encrypt your passwords.

Is it open source to verify that behaviour? Has anyone verified the source actually compiles into the binaries they offer?

Don't know about the OP, but I use a combination of sneakernet and scp to keep keepassx up to date across machines.

I suppose you could carry it on a usb drive.

I've been using Dropbox. Is that a bad idea?

I wouldn't necessarily say it's a bad idea, I'm just saying it's equivalent to using lastpass since it's a third party hosting your data. I think the usability of a third party syncing service is worth the potential risks.

The potential risks depend on the data, don't they?

KeePass by itself is not a replacement for Lastpass since it lacks (among other things) the ability to sync across devices or support mobile platforms.

i thought there's built in sync to ftp,webdav.. http://keepass.info/help/v2/sync.html , http://keepass.info/plugins.html#ioprotocolext adds sftp/ftps..

and an android app https://play.google.com/store/apps/details?id=com.android.ke...

...then be a hacker and implement it right, rather than wanting an all in one 'solution' that compromises security for the sake of not requiring thought.

Reply on news.ycombinator.com