keepassxc VS desktop

If you use KeePass, make sure you use the KeePassXC variant. KeePass is dead.

https://keepassxc.org/

That's why you use the superior one, KeePassXC, as linked in the NIST link: https://github.com/keepassxreboot/keepassxc/discussions/9433

Another regression is that KeePassX/C AutoType doesn't work with Wayland, so now instead of a simple CTRL+V in KeePassXC, I have to separately copy and paste the user and the pass.

https://github.com/keepassxreboot/keepassxc/issues/2281

That's really a shame, I know keepassxc has (recently) added support for passkeys, but does it also support import/exporting them? I only found this comment[0] in the github issue.

---

0: https://github.com/keepassxreboot/keepassxc/issues/1870#issu...

When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost.

Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL.

But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.net https://keepass.info https://keepass.cx https://keepassxc.org https://keepass-info.net https://keepass-manager.com

Which of these is the correct one? (It's https://keepassxc.org of course, but just looking at the URL won't tell you that.)

The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.

Appreciate the response. And I wish this message was front and center. The Attestation feature is what worries me, when, say, the bank turns it on for a few 'blessed' providers.

Watching https://github.com/keepassxreboot/keepassxc/issues/1870 with baited breath... :)

There have been requests. So far there hasn’t been an easy way to implement it, unfortunately: https://github.com/bitwarden/desktop/issues/90

If you activate the 'minimize when copying to clipboard' option in preferences, but need to copy something that is set to require master password confirmation, Bitwarden just minimises without copying the password. I made a ticket for that in GitHub in august '21, but that was closed after a 'reorganization' in April. My head was not in the space to check for this problem then, but I checked it now and the problem persists with version 2022.8.1. Of cause I appreciate help with the actual problem, but how do I best let Bitwarden know that this problem persists?

$ rpm -qp —scripts https://github.com/bitwarden/desktop/releases/download/v1.33.0/Bitwarden-1.33.0-x86_64.rpm postinstall scriptlet (using /bin/sh): #!/bin/bash # Link to the binary ln -sf ‘/opt/Bitwarden/bitwarden’ ‘/usr/bin/bitwarden’ # SUID chrome-sandbox for Electron 5+ chmod 4755 ‘/opt/Bitwarden/chrome-sandbox’ || true update-mime-database /usr/share/mime || true update-desktop-database /usr/share/applications || true postuninstall scriptlet (using /bin/sh): #!/bin/bash # Delete the link to the binary rm -f '/usr/bin/bitwarden'

Hi! We’ll find more info about that issue here: https://github.com/bitwarden/desktop/issues/1423

Thanks for the feedback everyone, you can follow the latest updates for this issue on Github.

Although we recommend using the latest version, previous releases can be found on the Github Repository if the current one is not supported by your device.

Thanks, these were the answers I was looking for too. Being a newb, which of these file links do I need to re-install on an old MacOS 10.11? https://github.com/bitwarden/desktop/releases/tag/v1.31.3

Raising an issue? I have a security issue that is more than a year old, quite popular, yet the devs pretend as if it wouldn't exist. At this point I don't think it would matter.

Luckily, Flathub is transparent in what manifests are used in the production of the Flatpaks they host. For example, this is the one for Bitwarden. You can take some time to learn how Flatpaks are built, but this one seems pretty straight forward. They are taking the .deb file from Bitwarden's github release page and extracting the executable from there. Then it adds a couple extra files, which are viewable within the manifest file, to make it into a Flatpak app.

There are a lot of electron apps I would like to see get official flatpak support, but the one I care the most about is Bitwarden, because I'm not comfortable using a "community-maintained" binary for something as sensitive as a password manager. I currently use the Bitwarden appimage. See also this issue.