8

I am using LastPass for managing passwords on multiple computers.

However, LastPass extension (at least the chrome version) is running some opaque binary code through Native Client, and I just feel that I don't trust the company running LastPass anymore, since it's based in USA ( https://lastpass.com/about-lastpass/ )

However, I don't know any other solution.

What I would want is:

  • a multiplatform program / browser extension, that works just as seamlessly as LastPass
  • said extension would work in a "decentralized" way
    • one solution I can think of is that it would let me select a file where the passwords are saved and encrypted with a "master" password, and I would share the file online via, say, DropBox
  • being 100% open source would be nice

I especially need the multiplatformity - I spend most of my time on OS X and Linux, but I unfortunately need to use Windows 7 and Vista time from time.

Improve this question
4
  • 2
    I don't think there's anything else quite as slick as LastPass. KeePass is an open source alternative and it does have a Firefox plugin. I'll be watching your question for better recommendations :-)
    – paj28
    Mar 23, 2014 at 13:15
  • 1
    To add to the conversation, here is the CEO of LastPass writing about LastPass here. security.stackexchange.com/questions/15822/…
    – user11869
    Mar 23, 2014 at 15:37
  • 2
    Well, CEO of LastPass can say it is secure and their binary code is totally fine, but... remember HushMail? Remember LavaBit? Even Microsoft tries to act like they never enter your mail, yet they do it like nothing when their intellectual property is endangered. Also, I don't trust a company that's from USA with my passwords anymore.
    – Karel Bílek
    Mar 23, 2014 at 18:25
  • 1
    In the link he doesn't say it is secure, he says audit it yourself and come to a conclusion on your own. There is a fundamental difference in the architecture of lastpass and something like lavabit, though. thoughtcrime.org/blog/lavabit-critique
    – user11869
    Mar 23, 2014 at 18:50

4 Answers 4

Reset to default
5

Working off of your three bullet points, I'll address KeePass.

a multiplatform program / browser extension, that works just as seamlessly as LastPass

Multiplatform: the official KeePass 2.25 support Windows XP through 8 plus Mono (i.e. Linux, FreeBSD, MacOS). There are a variety of ports, including KeePassDroid for Android, some for iPhone/iPad, Blackberry, MacOS, J2ME, Linux native, etc.

Just as seamlesly: Not as much (unless the browser extension does this for you), though if you master the "URL" field you can do things like simply switching to the KeePass window and let AutoType and/or Open do it for you - as a non-browser Windows example, you can hit Ctrl-U to open up a Remote Desktop window to the target, switch back to the KeePass window and press Ctrl-V to AutoType username and password; then you're in.

said extension would work in a "decentralized" way one solution I can think of is that it would let me select a file where the passwords are saved and encrypted with a "master" password, and I would share the file online via, say, DropBox

KeePass definitely lets you choose a file for each database, and you can share it via DropBox. KeePass 2.x also natively supports databases via FTP, HTTP and WebDAV, and has a plugin for SCP, SFTP and FTPS. Multiple machines can have the database open for write at once - it asks to synchronize when it detects another alteration as you're saving your own alteration.

KeePass also allows multi-factor authentication (i.e. passphrase + a key file or hardware token), which I would really recommend if you're making your database available to other parties - that way if you accidentally type in your KeePass database password into your DropBox login, someone at DropBox won't have everything they need to open your file. I say this because you mention you're worried about LastPass's integrity.

being 100% open source would be nice

KeePass is GPL licensed.

P.S. if you do use KeePass, upon creating each database, please go into File, Database Settings, Security, Key transformation rounds, and change that to a large number (start by pressing the "1 second" button/link and then multiply whatever that is by 2 to 12 or more; even on a decent smartphone ten million rounds doesn't take but a handful of seconds, and it'll slow an attacker down quite a bit.

P.P.S. you can also change a global setting on the main Windows KeePass program under Tools, Options, Security, Enter Master Key on Secure Desktop.

Improve this answer
3
  • I will have a look at it. Also, there seem to be an open source Chromium extension, altough I am not sure how well it will be working. I will tell you once I try it though.
    – Karel Bílek
    Mar 23, 2014 at 18:26
  • Is there a command line version of Keeppass, or a library that I hook into so I can automate it?
    – CMCDragonkai
    Mar 24, 2015 at 7:04
  • @CMCDragonkai you can just download the KeePass Source Code - it's under a GPLv2 license.
    – Anti-weakpasswords
    Jun 14, 2015 at 17:14
2

I suggest Enpass

Multi-platform - Offers an app for everything from blackberry to windows

Decentralized - They dont store your passwords, you can Chose to upload it to your own cloud account if you wish.

Open Source - No.

Improve this answer
1

1Password is a Canadian competitor of LastPass and fulfills your three requirements.

It is completely decentralized. They don't get your data and they don't get your password. They simply ship an application, they don't have backend servers.

You can sync your encrypted data in iCloud and/or Dropbox.

It offers Windows desktop, Mac OS X and iOS version. And plugins for Chrome and Firefox.

It also offers a 1PasswordAnywhere browser-based application that runs on Dropbox.

So they don't ever get your data or password. If your Dropbox (or iCloud) is compromised, the attacker would only see the encrypted blobs.

As a user of 1Password, I'm quite pleased with the product even though it does not offer as many features as LastPass (no OTP, for instance).

The only grief I somewhat have against the company is their refusal to provide a good experience on Windows devices : they won't offer a Modern Windows Store, the IE plugin does not work with the latest IE11 version and their Windows Phone version is a joke (old, not maintained and read-only).

Improve this answer
1
1

I'll suggest Password Safe as I think it addresses all of your points.

  • Multi-platform. There are implementations of the software which are compatible with each other and run on Windows/Linux/Mac/iOS/Android. I generally use Password Gorilla to keep the same client on multiple platforms.

  • Decentralized. Yep using it with Dropbox seems to work fine for me. the iOS client that I've tried supports loading from Dropbox and the Android one can get the file from the Dropbox folder.

  • Open Source. Yep the original project is open source.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .