The biggest weakness is the cost. Each client would have to purchase an expensive license. The source code is provided upon purchase though, but essentially destroys the ability to build a client from source due to the compiled binary distribution.
With cases like these, is it possible for you to simply copy the important text data into a note, or do you absolutely need the full pdf? Most attachments can be reduced down to their barest text form to avoid bloating the db.
Yes we agree. Keep the passwords in the password manager and keep the files in the EOFS. If you need true seperation between those files, just make different containers or FS for them.
Jason Donenfield is just a juggernaut. From WireGuard (and the client apps on every platform!) to passwordstore to cgit. This guy is insane. I’ve also always loved the look of cgit. Reminds me a lot of the Fossil VCS web interface in some ways.
Exactly. As such, people in the thread with huge dbs have a poor UX when they really do not need to. Also, people who have experienced corruption issues on network storage due to the default saving method (I personally have never experienced this).
Of course, the technical backbone of a product is rarely a user concern. But, changing the store allows for new design decisions when making the schema that are not tied to the old (IMO) technical debt of the KDBX format.
Users have wanted proper custom entry templates for years in order to input their card details into the manager. BitWarden, CodeBook, and others all have this built in without needing to fiddle with attributes and autofill to make it work.
I think a major change like this is worth it when we consider the KeePass of the next decade or two. This is genuinely my most important file by a longshot. Basing it on SQLite is just the right move for future proofing.
> The migration process would also be frictionless for users, it is a simple data map between probably the two easiest formats of all time.
I cannot imagine how you could mess this up. The developers already implement numerous export formats. The migration is the easiest part. The actual implementation of a new data format into the codebase and all the new security and robustness testing is the difficult part.
KDBX seems unique in this threat model out of the major providers. The cloud ones all use a relational DB, while major local ones like Enpass & Codebook just use a SQLCipher store. I wish someone with some real experience here would chime in: What metadata does a SQLCipher DB leak that a KDBX file does not? I mention that both of them obviously reveal the size of your vault to an attacker (w/ KDBX reporting the size more accurately, ultimately irrelevant), which is pragmatically unavoidable information leakage.
You lose the convenience of one file though. In this case you might as well use a purpose built encryption tool rather than force KeePass into this usecase. A VeraCrypt container or encrypted overlay filesystem are a significant performance and UX upgrade since you are already willing to concede managing one file.
Really? To me that app is like the WeChat of banking. It just does so many things. Do not even get my started on the non-standard long totp that they force you to enter when trying to navigate certain parts of the app (you're already authed, why reauth?!).
I think the Schwab app-for doing as many things as the Chase app, is a much smoother experience.
A commenter here recently just asked me if I have considered BitWarden due to my gripes with KeePass. KeePass cannot rent-seek off my passwords. You can of course host BitWarden, but the official software can always get worse (see Minio). Thankfully we have community run versions of the BitWarden server (VaultWarden), whereas 1password customers are left to dry. There just isn't any money in personal password managers, and restricting features like TOTP (BitWarden free tier) rarely entices the average person to get a paid plan.
This is a reductionist take on what password managers actually need to do. A journal log is actually worse than the XML in this regard in that the number of events far exceeds the actual relevant relations. Also, adding an attachment/icon his no longer possible. Simple group associations and tags also become a complex nightmare in a log based system, whereas in SQLite they are super easy relationships. Relating passkeys, totp strings, icons, extensive history, etc all to one entry becomes too much of a task for that kind of format to handle.
Hey I’ve seen your project before! You bring up a super good point that I was thinking of when I brought up the idea that the extension should be renamed to .kp . Really the only reason to keep the KeePass name would be branding, people know and trust it. Honestly my dream password manager is essentially something that uses the CodeBook (by SQLCipher authors) storage format, but with the nice trustworthy, FOSS KeePass ecosystem chrome on top of it (keepassxc<-browser>, keepassium, etc).
Exporting to a relational db is beside the point. You can very easily just export a CSV file and double click it in DB Browser and have something working. Or you could export the XML document and write a quick importer for it. But genuinely what benefit does it provide other than allowing me to hack at my unencrypted db with sql statements? All the benefits that I was referring to are for daily usage of a KeePass client, not for a one off export.
Hey I’m with you here actually. Synctrain on iOS makes it bearable, and actually wakes itself up periodically in the background to do a sync. It’s not as good as it could be, but far better than the alternatives. Otherwise you can spin up WebDAV and direct connect via keepassium. Both work well in my usage.
Yes actually, I have personally onboarded several people to BitWarden! (Including manually migrating their accounts, setting passwords and passkeys, etc) However, I dislike the centralization and lack of control. There was a paper discussed within the past couple days on HN about what a malicious BitWarden server was capable of, despite BitWarden's marketing. I believe BitWarden's team responded promptly and appropriately to the research.
VaultWarden is a good compromise (offers the choice of SQLite or Postgres under the hood), putting you in charge of the primary server, but it is honestly overkill for a single personal user compared to a kdbx file on a webdav share.
Because KDBX is a gzipped and encrypted stream, this is actually fundamentally an issue with the spec itself. A client must re-encrypt and compress the file prior to writing because a mere append operation is not possible. SQLite solves this issue by allowing you to write with page level granularity rather than being forced to dump the whole file for a single tiny change!
I’ve typed out an initial response of disappointment and disgust, only to delete it and reference an anecdote about current students, just to delete that again in my lack of words for this progression. I miss when a written piece meant someone cared to write it.
I genuinely don’t know what openclaw even is. I doubt it’ll matter in 6 months when we have some new Linux desktop manager that’s just a Gradio web UI uses your OS for you lol.
Forget business secrets. In my anecdotal surveys, normal people are feeding their entire lives into the normal web ui! Many of these people are on the free plan with no data protection at all! People I know have admitted to feeding chat transcripts, documents with tons of PII, most email correspondence, their private IP (medical texts, fiction, lyrics), and don’t even get me started on the emotional counseling.
I’ve had a long history of managing my digital privacy and even I’ve been quite lax with this. It’s just so easy to dump stuff in the black box. I try to use ZDR endpoints when I can via openrouter for certain tasks.
Google’s policies regarding data collection on paying customers is so shady as well. From what I understand: they train on all days of all paying customers unless you turn Gemini apps and activity off. This completely disables your ability to save chats. They obviously merge these two settings to collect as much data as possible. They allegedly do not train on temporary chats, but the UX for them is annoying and requires so many more button clicks.
Ultimately I just treat any endpoint as a public record at this point. If I wouldn’t be happy letting the world see it, I don’t attach it. Welp.
Likewise with the resolution. I briefly maintained a dual monitor setup, one was a vertical 1080p 27 inch monitor and the other was 4k. The pixel density of the 1080p monitor was genuinely Paleolithic in comparison, so I couldn’t even use it because of how obviously I could tell. But when it was my primary monitor it never occurred to me.
I once heard a rumor going around the cs:go world that Linux had lower input latency by default than windows, which made it easier to bunny hop. Is there even a semblance of truth to this?
I remember one time I was playing Fortnite 1v1s with a friend and just kept losing. Something felt severely off, my game inputs felt terrible. I couldn’t quite trace my finger on what the issue was until I lost a couple rounds in a row. Turns out I had forgot to set my refresh rate to 160hz, as I had just fresh installed Windows so I could play with my friend. After that I genuinely won dang near every round. It is absolutely insane how when you switch from 60hz to 120+ you don’t really notice anything—but switching back makes you feel like your device is defective.
I’ve noticed that too. I have kind of a wonky password that’s hard to input correctly due to having to hold shift for 2 characters in a row that are in the middle of the password. I’ll enter a password and completely think that it was wrong just to be let in. It often feels like I clip the last letter wrong too and I just get let in. Fun.
It doesn’t perfectly map, but it gets a visual point across. I cannot be convinced that it’s better for the average person to maintain a couple permutations of a primary password for a hundred different sites than it is for them to store it in a vetted and audited password manager. Even with the vulnerabilities mentioned in the paper you are far better off with a password manager and thus 100 fully unique passwords then without.
Hello. I use copyparty on my LAN hosting the kdbx file. It is exposed via webdav for my phone's client (keepassium). It is always available for KeePassXC (you can use rclone or just webdav in the file explorer). This is backed up to b2 every hour. I use WireGuard to access the LAN when I am not home. My phone autoconnects to WireGuard as soon as it is on any network that is not my home network.
Fair enough, but it’s genuinely super easy to have a regular copy of your password manager saved in the cloud. You can also have a less frequently updated version stored somewhere physical that isn’t your house. My house burning down has never been a concern for me, as I’ve taken the proper precautions for my data.
I don’t recommend any of them. Some of them have critical metadata leakage issues (Pass and derivatives, which leak the number of accounts & their names) and most others are not open source—an immediate disqualification for a local password manager. KeePassXC is my choice on desktop. Keepassium on iOS.