Keepass Must-Haves?

Discussion in 'other software & services' started by Alchemy, Nov 4, 2015.

  1. Alchemy

    Alchemy Registered Member

    Joined:
    Aug 27, 2015
    Posts:
    4
    For those of us who have jumped ship from LastPass and have just started using Keepass; are there any must-haves to make the transition smoother?

    I have seen plugins like chromeIPass and CKP, but both seem to have a fairly small number of users and not many details on security.

    There are also mobile solutions like "Keepass2Android" which is open source and well rated.

    So which solutions/plugins/apps do you guys use with your Keepass? and how would you rate them?
     
  2. TS4H

    TS4H Registered Member

    Joined:
    Nov 5, 2013
    Posts:
    523
    Location:
    Australia
    I am currently using Keepass, just as trial incase i am no longer satisfied with lastpass.

    ChromelPass works well with many sites but does not work well with sites that have a drop down login interface or a popup interface for login. But overall it works as expected given the sites I access. There are two reasons why i think those extension you mentioned are not that popular, however ChromelPass is from a reputable contributor to the keepass project.

    IMO, all you need is keepasshttp and ChromelPass.

    Ist reason) ChromelPass requires the extension KeePassHttp to securely communicate between the native windows client and the browser over http. Some users may not trust this method or aspect of keepass given the extension is made someone else other than Keepass.

    2nd reason) The idea of keepass has always been not to be cloud or browser dependent. If someone wants to access a login site, they can access the keepass GUI and have keepass autotype login for you. This may prevent keyloggers and act as a work around for the 1st reason.

    Overall the experience has been good. Most windows client based software will have a similar experience. Some however work better than others. But all use a browser plugin or extension of some sort that some may find either a positive or a negative.

    The usability of having your password synced accross multiple platforms IMO is not that good. In some cases hard to set up depending on which option you take. For this reason, 1password, Dashlane and others are better in my opinion.

    The ease at which lastpass can be used is far superior to any native client IMO. Its one of the man reasons for its success. I will continue to use keepass for the time being while still having my lastpass account.

    Keepass has many security functions such as masterpassword and keyfile, with my prefered use of the keyfile being in usb, or in an android storage container (in phone) etc.

    The project is very active with continuous development.

    Hope this helps. Regards.
     
  3. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,453
    Location:
    .
    Firefox 32b primary with KeeFox and Chrome 32b seldom use with chromeIPass.
    Setup Firefox Master Password too. My version of 2FA
    Edit: Firefox 64bit
     
    Last edited: Nov 7, 2015
  4. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,098
    Location:
    USA
  5. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    hi
    i use with firefox ,and my laptop and desktop
    but not for android

    but about android i wonder how secure is having installed on a mobile phone
     
  6. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    3,418
    Location:
    Slovakia
    When creating a new password, do not forget to tick TCATO for an each entry, it is not enabled by default and it is somewhat hidden.
     

    Attached Files:

  7. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    hi TairikuOkami
    thanks , i have never seen it before :(
    is there a global option ?
    is there a way to add this option to many passwords?
    thanks
     
  8. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,453
    Location:
    .
    When I create "new" I step through tabs and add Two-Channel Auto-Type Obfuscation. I'll use if site does not fill.
    Maybe, you'll like watching and prefer auto-type.
    Note: auto-type is not auto-fill.
     
    Last edited: Nov 7, 2015
  9. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167
    yes
    sadly i have many password without Two-Channel Auto-Type Obfuscation
    in short i must edit every password and add this feature , i can 't add this feature to all my password with 1 click
    thanks
     
  10. bjm_

    bjm_ Registered Member

    Joined:
    May 22, 2009
    Posts:
    4,453
    Location:
    .
     
  11. AutoCascade

    AutoCascade Registered Member

    Joined:
    Feb 16, 2014
    Posts:
    741
    Location:
    United States
    http://arstechnica.com/security/201...-encrypted-credentials-from-password-manager/

    "Using a password manager is one of the biggest ways that average computer users can keep their online accounts secure, but their protection is pretty much meaningless when an end user's computer is compromised. Underscoring this often ignored truism is a recently released hacking tool that silently decrypts all user names, passwords, and notes stored by the KeePass password manager and writes them to a file."
     
  12. TairikuOkami

    TairikuOkami Registered Member

    Joined:
    Oct 10, 2005
    Posts:
    3,418
    Location:
    Slovakia
    If the computer is compromised, it is over. Then again a proper way is to have a keyfile on a separate device (USB) and plug it in only when needed.

    EDIT: KeeFarce is a nice tool, but it needs to be run first, that means either by a user or by itself, thanks to disabled UAC, enabled scripts and so on.
     
  13. chrisretusn

    chrisretusn Registered Member

    Joined:
    Jun 16, 2004
    Posts:
    1,669
    Location:
    Philippines
    KeeFarce only works if running and if KeePass is running and the database is unlocked.

    Key files are great. Just make sure you have multiple copies stashed safely away somewhere just in case something happens to the key file in use.
     
  14. SirDrexl

    SirDrexl Registered Member

    Joined:
    Apr 14, 2012
    Posts:
    556
    Location:
    USA
    Sure. But let's be real; most people in a non-public setting are going to open the database as soon as they start browsing (or at least at the first site that needs a login) and then keep it open until they're done browsing, probably until the next shutdown. Frankly, if I had to re-open the database for every login, I'd consider switching to pen and paper.

    Of course I would lock it if I'm getting up from the computer with someone else around, but if this malware gets on the system the database only needs to be open for a few seconds.

    As for the original topic, I like the plugin Favicon Downloader, which makes it easy to get the favicon for each entry.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.