I used both KeePass and 1Password is not just about the pretty interface as you make it to be. Entire UX is much better.

Also, even if some 3rd party looked at the code, it doesn't really matter because they are really transparent about the file storage format, there are even some open source cli tools to extract data. Also it is a fact that no data leaves your control. No server side storage or something like that.

I believe 1Password has a great model for a closed source password manager here.

KeePass had been really unreliable and I could not just trust it to store anything. Maybe I should give it another shot. LastPass and other "server side" storage services are not even an option for me though.

You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.

One important thing is, my data directory is on my computer. It's not transmitted over any wire. Unless NSA comes knocking... Of course if you want to sync then it goes through dropbox then you have a problem. But they stated that the new version will be able to sync within a wireless LAN.

And If you don't really trust 1Password's encryption, it would be trivial to relocate data files within a trucrypt container or something. (I know this is somewhat ridiculous)

Oh for sure. My original point, way back up tree, still stands though. If you care about security, surely you should care about security. If the data is just on your computer and you're not worried about people getting access to the file why don't you just use a text file, or get the browser to save passwords, or a billion other possibilities that don't cost USD$50-70?

There is something to be said, I suppose, for "well if I sell my computer and forget to dd the drive / it gets stolen then it stops randoms from easily gaining access to my stuff". You then need to wonder if that's the only file you wouldn't want people being able to access. If it turns out that there is other stuff as well, perhaps encrypting your home directory is a smarter idea (I hear there isn't a massive performance hit these days)?

With LastPass, all data are encrypted locally on your machine so except if there is a backdoor in their extensions/desktop applications, you are normally pretty safe.

http://www.tobtu.com/lastpass.php why nobody should use lastpass

Thanks for the read, will probably switch to KeePass then.

Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.

Keepass runs reasonably well using mono. There are some bugs that would cause problems for real power users - for example, opening multiple databases with the same instance of 2.x is bad - but for basic use it's more than good enough. If you're on an ubuntu or debian, I use jtaylor's PPA: https://launchpad.net/~jtaylor/+archive/keepass

Does 1Password have a Linux client? Looking at their page, they appear to only support Mac, Windows, iOS, and Android.

No, but it runs fine using Wine. I created a shell script to launch it with a key-stroke. If you want browser integration, you can run Firefox in Wine as well (or Chrome).

they create an HTML file in your Dropbox (when you sync) that you can hit with any browser.

Just opening the 1PasswordAnywhere html file in Firefox doesn't work. Something about Firefox's local file access policy. I serve the HTML file with `python -m SimpleHTTPServer` and visit localhost:8000 to use it.

KeepPass2 is actually built on Mono, the open source multi-platform .net clone. It just happens to work with M$ .net.

I have it running on OS X, Linux, Android and Windows, all at the same time, while singing changed across platforms with secure Web Dav based cloud storage. Took me 20 min to set up on all four devices.

As someone who had their passwords leaked by an attack against one of the largest commercial password safes just a few years ago (heard of pwnedlist or the LastPass beaches?) I have been happily using KeePass as amuch more secure FOSS alternative with equal (if not more) functionality ever since, without any hangups to speak of.

As other said, Keepass2 works under Mono.

Even better, Keepass2 is included in the Ubuntu official repos. And it runs pretty well. Autotyping your password into other programs also works. I really like Keepass2.

  sudo apt-get install keepass2

Good luck!

I use KeepassX on Linux, Windows and Android.

I have been using KeepassX for years on Linux, Android and OSX. No problems anywhere. Yes, the interface isn't the most '2013 flat UI webapps' whatever, but it's simple, and works.

We're currently moving our office over to KeepassX for our lists, also iOS clients, Windows and for a while I had it quite happily on my java feature-phone. (Entering the master password on the feature-phone was a bit fiddly though...)

There are Keepass ports for every major OS.

Since it's open source, anybody can implement the client.

I agree that using anything non-opensource for this particular purpose makes no sense whatsoever.

But when I tried keepass a few months ago (maybe a year) I wasn't able to get it running properly on the Mac. Half the UI was somehow missing.

I'm using a simple text file stored in a truecrypt drive.

KeePass is utterly unusable for ordinary users. Especially on non-Windows platforms, where it takes voodoo to make it even run.

Really? I use KeePassX on Linux and it literally could not be easier. I just enter my passphrase and my password file opens up, there's not much more to it.

EDIT: Apparently KeePass and KeePassX are different?

KeePassX started as Linux client for KeePass but since then has become cross platform. I have not investigated yet what are the main differences between the KeePass and the KeePassX applications on Windows.

Really? I find Keepass works pretty smoothly. On Windows, granted.

I did have trouble with it on OSX but the KeepassX client does ok.

You need to be more specific, because in my experience that's not even remotely true. There wasn't a single "weird" step involved in using it, and I use it on Windows, Mac, Linux and Android (3rd party client). You create a db, with a password or a key (if you don't know what a key is ignore it), and then you can add passwords. Done.

What about Bruce Schneiers Passwordsafe?

I mean http://pwsafe.org/

I used Keypass for a couple of months. It was very unstable, regularly crashed my browser, and I lost all of my passwords at one point.

I switched over to 1Password and never ran into these issues.

So I've never used the browser integration, which might be why I've had a more stable time of it, but I use it over dropbox on windows, Mac and Linux and have had exactly 0 stability issues, with either the 1.0 or 2.0 clients.

The only downer is that the Linux / mac builds don't support automatically locking, which is a pain. If I get time I'll look at submitting a patch

Agreed. KeyPass was terrible the last time I used it. Once I used 1Password I never looked back.

There are other good password managers (e.g. LastPass), but KeyPass is not one of them.

Ive used KeePass and KeePassX on Windows, linux, android, and iOS for over 3 years now, and I've NEVER EVER once had an issue like you guys are.