Hacker News Reader

Comment by jbi | Hacker News Reader

As KeePass uses a single (encrypted) file, you can use any hosting service that you want. Just make sure you save the new version back into your storage when you edit entries. You can use Owncloud, Google Drive, OneDrive, ...

View on HN

LastPass provides a web frontend though, which may be a feature GP is after.

I mean, I think having a Web UI for your password manager is fucking insane, but some people like it.

What is insane about it?

because now you have to think about the attack surface of the browser; CSRF, auditing your chrome extensions to try to make sure none of them are exfiltrating your tab contents / metadata, etc etc etc

Ahh shit, and i was just beginning to think that a site i found a while back (can't remember the name) which used a hash function to generate your passwords

hash(strong_master_pass + site + user)

was a perfect solution...

There's just so many things that could go wrong when you start trusting your web browser to access a password vault.

Don't forget that with KeePass you can also use as many files as you want. I know that I've been slowly moving from a single password file to a small constellation of context-specific password files. It's an interesting tool in the toolbox and you can even use that to help do things like manage the sync characteristics per KeePass file (this file should never leave this device, this file is synced by Resilio Sync, I'm alright with this other file hanging out in my OneDrive for easy access on devices I only partially trust, etc).

Reply on news.ycombinator.com