Hacker News Reader

Comment by csours | Hacker News Reader

Software needs to be

Secure by Design

Secure by Default

Secure by Deployment

I can't comment on Deployment, but the defaults are not secure (defaults to autofill info), and it's not secure by design - surface area is much too large.

For me to trust lastpass, I will have to see real changes on those.

View on HN

Security isn't an absolute thing. Just the fact that you use the internet indicates that you're willing to sacrifice a significant amount of security, which is clearly worth it to you. Presumably most LastPass users prefer autofill browser integration.

Going outside makes me less secure, but I usually put on clothes and shoes before I do it.

And a helmet and gloves?

Sometimes, yes. Usually for the bicycle and the cold.

I highly recommend KeepassX instead. https://www.keepassx.org/

It's a local db only, you're in full control of where it is, where it goes. It's one of my favourite pieces of software actually: Simple enough that my aunt is using it, secure enough that I'm using it for my company's accounts.

KeePassXC is a fork of the 1.x version. Fixes all the annoyances that the official 2.x series somehow never got around to. Recommended.

https://keepassxc.org/

xc is a fork of the 2.x series. I would possibly recommend it, but it's less battle-tested and they're aiming to enable the HTTP server by default which I think is a mistake. I'm using it, but disabling that stuff.

(Either way the databases are compatible with one-another, so it's up to you what client you use)

You're right. I'm thinking 1.x because it has kept and augmented all the useful 1.x behavior which the regular 2.x somehow managed to butcher.

And you can always store your DB in a "cloud" drive. This is what I do and I'm fairly happy with it. Granted it doesn't have the features and ease-of use of online password managers, but my workflow allows me to live with that tradeoff.

I have quite a few sites I need to share credentials to with my wife, but we each have other credentials we don't need to share. Is there straightforward workflow for that with any of the KeePass variants?

One keepass db per person for your personal accounts. One separate keepass db for your shared accounts.

Are there any special considerations that need to be made with regards to synchronization? I'd expect the DBs to be mostly read-only, so maybe it won't matter much. But I'd hate for a write conflict to leave things in an inconsistent state.

Edit - Thinking about it more, I suppose it really depends on what each cloud provider does.

Yeah you gotta make sure you're syncing the db properly when you write to it. It works ok with two people, but it doesn't scale much further than that.

Thanks for the info. I'll give it a shot.

Reply on news.ycombinator.com