News for hackers. Stuff that matters.
Re:KeePassXC 2.6.0 Released by trabant00 on Wednesday July 08, 2020 @09:13AM (#23769534)
Another option you should consider: https://www.passwordstore.org/

It's just a bash script that used gpg and git. I find it the most KISS solution. Not available on phones but I don't trust my phone with my secrets anyway.

Re:KeePassXC 2.6.0 Released by c0bruhh on Wednesday July 08, 2020 @09:27AM (#23769655)
I use "Pass - Password Store" [1] for iOS and it works a charm for me.

You have to import your GPG key to it and set up your git connection to your server and you're all set.

It also supports OTP generation which is really nice.

[1]: https://apps.apple.com/us/app/pass-password-store/id12058205...

Re:KeePassXC 2.6.0 Released by marcthe12 on Wednesday July 08, 2020 @12:35PM (#23771519)
How is it compared to keepassxc.
Re:KeePassXC 2.6.0 Released by woile on Wednesday July 08, 2020 @09:20AM (#23769579)
There's an android version: https://f-droid.org/en/packages/dev.msfjarvis.aps/

I use it and it works quite well.

Also gopass exists, which is useful to share secrets with teams + your personals, same interface. I wrote about it [0] + a cheatsheet [1]

[0]: http://woile.github.io/posts/sharing-team-secrets/

[1]: https://woile.github.io/gopass-cheat-sheet/

Re:KeePassXC 2.6.0 Released by djagoo on Wednesday July 08, 2020 @09:23AM (#23769608)
Passwordstore is just awesome. We're using gopass (go port of the pass scripts) which supports multiple stores to be mounted so we can have different recipients i.e. for team1, team2 and private. In combination with browserpass for firefox and android-password-store for smartphone it's the simplest and best tool I ever used for password management. And the best part: it's just simple text files which are encrypted using gpg. So we just sync them with syncthing and even if the pass or gopass program would go away in the future we can use gpg decrypt.
Re:KeePassXC 2.6.0 Released by adrianmonk on Wednesday July 08, 2020 @01:54PM (#23772388)
I've heard claims that using the clipboard to transfer passwords is not very secure because a lot of different pieces of software may be able to read the clipboard.

If so, then a browser plugin would seem to provide better security. So this might be a little too KISS.

Does anyone have comments on how much of a concern it really is to have passwords travel by the clipboard?

Re:KeePassXC 2.6.0 Released by dspillett on Thursday July 09, 2020 @05:40AM (#23778477)
> how much of a concern it really is to have passwords travel by the clipboard?

As with many security matters, it will vary depending upon your threat model.

I generally feel that if you have something installed watching your clipboard for nefarious reasons then you've already got a bigger problem, and I prefer that potential security issue over having all my credentials integrated into the browser via a plugin (a clipboard sniffer will catch one or two things passing by, a hacked browser with integrated or add-in based password store might reveal everything at once).

If you use the clipboard for transfer, take the precaution of always clearing it soon after use. KeePass does this by default, as do some other similar tools.

Re:KeePassXC 2.6.0 Released by ComodoHacker on Wednesday July 08, 2020 @09:19AM (#23769574)
I can't count a requirement to have git wherever you need a password as a KISS solution.
Re:KeePassXC 2.6.0 Released by djagoo on Wednesday July 08, 2020 @09:25AM (#23769627)
You can set up your store with git but it's optional.
Re:KeePassXC 2.6.0 Released by dewey on Wednesday July 08, 2020 @09:28AM (#23769656)
> Not available on phones but I don't trust my phone with my secrets anyway.

Why is that? I trust my phone more than any other device because of it's encryption / secure enclaves / sandboxing etc.

Re:KeePassXC 2.6.0 Released by trabant00 on Wednesday July 08, 2020 @01:04PM (#23771829)
I don't have root on it. I didn't pick the hardware.
Re:KeePassXC 2.6.0 Released by ufo on Wednesday July 08, 2020 @03:20PM (#23773300)
One thing that bugs me about passwordstore is that while passwords are encrypted, the names of the websites are stored in the clear. Last I saw there is an workaround you can use with "tombs" but IMO it would have been much better if they had done the right thing by default and stored the whole password database in a single file.