Hacker News Reader

Comment by andrey-p | Hacker News Reader

Currently using KeePassX + Dropbox. What sort of benefits would I get from Mitro?

Currently, this is the best option. Though I recommend KeePass proper as opposed to X since KeePassX's last stable release was over 4 years ago and they've only pushed out alpha builds since then.

Unfortunately, if you want to run on Linux, KeePassX is the best choice. KeePass "proper" does work on Linux under Mono, but the UI is pretty buggy (textfields don't render the cursor in the right place, and the UI just looks awful in general). I really do wish there was a better native Linux client - some new features would be nice.

There are several good reasons to use KeePassX over Keepass, even with the current status of Alpha 6 in the KeePassX 2 series.

* KeePassX has a consistent UI across Windows, OS X, Linux * It's a small, portable binary. I've had good luck running the Windows and Linux binaries off of USD drives. * Alpha 5 and Alpha 6 have been really stable. I started using Alpha 5 and haven't had a need to look back.

I've been recommending KeePassX as the go-to password manager for Windows, OS X, and Linux over Keepass.

I use Keepass2 exclusively now(started using it this past year due to needing windows and cloud sync support) and have had no major issues across linux and windows. I guess YMMV, but it's been a great success for me.

Not keeping sensitive data in Dropbox.

Even if it's encrypted?

http://www.theguardian.com/technology/2014/jul/17/edward-sno...

https://www.techdirt.com/articles/20130620/15390323549/nsa-h...

The KeePass database is strongly-encrypted before you put it up on Dropbox, so you're not relying on Dropbox's own encryption (I wouldn't either).

I refer you to the techdirt article linked above. If you upload a KeePass file to dropbox now, you may be vulnerable to a way of cracking keepass files available at some future date.

This shouldn't matter here, if you regularly rotate passwords and KeePass itself is regularly updated to fix security vulnerabilities.

Yup; but I'd say you're letting the perfect be the enemy of the pretty damned good.

KeePass' encryption is quite solid -- if it starts to show some cracks in the face of quantum computers or whatnot somewhere in the future, I can always upgrade and change my passwords so the old database isn't valuable any more.

That'd be a PITA, but I don't expect this to happen -- nor for the govt to come up with a huge vulnerability that no one else sees -- so that's the kind of bet I'm comfortable taking.

Is there a "secure" way to get a KeePass file onto an iPhone if Dropbox isn't safe?

I don't need realtime sync, I'm happy to manually copy it across when I make changes, just curious what the proper way to do it is, if not via Dropbox.

SpiderOak: https://spideroak.com/

It's Snowden-approved! http://blogs.wsj.com/digits/2014/07/17/snowden-says-drop-dro...

> Is there a "secure" way to get a KeePass file onto an iPhone if Dropbox isn't safe?

I have an android phone. I use a technology called a "USB Cable" to transfer files onto it.

Sadly that is also very insecure:

http://www.theregister.co.uk/2014/07/31/black_hat_hackers_dr... http://appleinsider.com/articles/14/08/01/badusb-malware-liv...

but at least it is safe against remote intercepts.

I'm in the same boat (KeePassX and Dropbox), but I have been thinking about a peer-to-peer sync option. I don't need it to sync on WAN, just LAN sync is probably good enough for me. If it syncs between my couple of laptops and my phone, that's good enough for me. I have to see if BitTorrent Sync helps me do this.

Reply on news.ycombinator.com