Keepass Tutorial: Your Password Manager

Tux and Keepass logo

Password management is very important to keep our systems and accounts secure. Every time we access more services and therefore we have more passwords. Having a single master password for all sessions is a serious mistake, since if they manage to hack it they will have access to all your accounts and sessions. That is why it is advisable to have a password for each service, but this makes it difficult to remember them all ...

Using strong passwords, longer than 8 characters and combining numbers, lowercase letters, uppercase letters, and symbols is best. Also, these should not be special dates, mascot names, favorite soccer teams, or the like, as they can be figured out by social engineering In a simple way. It is also not a good practice to write them down in a note under the keyboard or next to the monitor as some do, since they can be seen by third parties.

These new measures make it difficult to manage and remember them safely. So, having projects like Keepass is of great help. That is why we have dedicated this post to decipher your passwords, teach you how to use it and so that you can understand the pros and cons of using this software for security.

Advantages and disadvantages:

Informatic security

KeePassX, as you already know, is a multiplatform, open source and encrypted password manager. What it does KeepassX is to store passwords safely so you don't have to remember them. It does so in the form of pairs: username-password, for optimal control of this type of session. With a master password you can access the application, generate encrypted files with your passwords, save them in a shared directory or send them by email if you need it.

This advantage can turn into a disadvantage, since if it stores your passwords it can be a good focus where to focus an attack to try to get the master password and be able to have the passwords of all the sessions of a specific user. Sometimes analog media can be the safest no matter how advanced digital media is. By this I do not mean to write it under the keyboard or paste a post-it next to the monitor of your computer ...

On the other hand we have another virtue and it is its encryption to be able to share passwords and use them from wherever we want safely. Allows you to choose whether your encryption will be based on the algorithm of AES or Twofish encryption with a 256-bit key. But many say that the only safe thing is a computer disconnected from any network and isolated from the presence of third parties.

Although AES and Twofish are two fairly reliable algorithms, they are not foolproof. There are no known efficient attacks to brute-force keys out of Twofish, but that doesn't mean there aren't or won't be. On the other hand, AES, was adopted as standard by the United States government and is widely used by many systems, but the NSA declared that it is sufficiently secure (as efficient attacks have not been detected), although they do not recommend it to encrypt classified government documents, in addition to suspecting possible weaknesses in 128-bit keys (although Keepass use of 256bits).

As I say, both algorithms are quite reliable, but there are some suspicions about their strength. However, unless you are a very juicy and interesting target, you can be quite safe with this encryption, since not many will want to waste time getting their password to access data with little value. However remember that there are some attacks involving more direct methods than attacks by brute force, by dictionary, Rainbow tables, etc., such as the social engineering we are talking about ...

To add more data, an alternative that we will analyze below called LastPass, has been donekada. Its developers have had to report suspicious activities that withheld information from the users of this password manager. And that is the big problem of keeping all the passwords in one place ... If you keep your house, garage, business, car keys on a key ring, a single access to this key ring would give you free access to your home, business, garage and take your car. The same happens with passwords.

Tutorial:

Keepass interface

KeepassX is a version of Keepass Password Safe, a tool initially created for Microsoft Windows operating systems, but which has been ported for other operating systems. The final X identifies the version for Linux, but it can also be installed on iOS, Android, Mac OS X and Windows Phone. Although these versions are "unofficial", they work like the original and have even created programs for BlackBerry (KeepassB), Sailfish OS (ownKeepass), Chrome OS (CKP), for users of Mozilla's Firefox browser (KeepFox), etc. .

To install KeepassX in our distro and be able to use it we can follow this step by step guide:

  • The first thing to do is Download KeepassX.
  • As you have seen, it is a tarball with the source code. Now we must unpack it and compile it for your installation. For this you can type this in the terminal. For example for version 0.4.3 that I have downloaded in the Downloads folder of my distro:
tar xzvf KeePassX-0.4.3.tar.gz

cd keepassx-{version}

qmake-qt4

or it can also be (depending on your distribution):

qmake

make 
make install

If you see that this last command does not work, try:

 
sudo make install

  • We can now start using KeepassX. KeepassX will work with databases, which is where the encrypted passwords of users are stored on our hard drive. To encrypt the passwords we can use a master password and / or key files. At this point we must remember that we cannot forget our master password, since we will not be able to access the rest of the passwords and that it must be strong so that it does not expose the rest of your passwords. If you opt for a key file, it acts the same as the master password, as you must provide this file to KeepassX to decrypt the passwords. You can have it on a pendrive or any external medium that only you have, since if you store it locally it could pose a risk if someone has access to your computer. And above all make sure that it is not modified, since it will not work ...
  • To start storing passwords, open KeePassX and select «New database»From the File menu. A dialog opens asking for the password file or the master password. Enter it and verify it according to your choice.
  • Now we have our database for passwords created. We must select in the File menu the option «Save database«. This database file can be moved to another computer or external medium and you can access it with KeepassX and the master password or password file.
  • We can create and organize our passwords by Groups. KeepassX will create, delete or edit them from the Groups menu or also by right clicking on the group left panel
  • Since "Create New Entry»We can add a new password. It will ask you for a descriptive title to identify which password it corresponds to, the username, and the password. If we accept, the password will be saved in the selected group.
  • Once created, it can be edited to modify or delete it if necessary, for this, click on the new entry with the right mouse button or touchpad and select the option corresponding to what you want to do. .

Alternatives to Keepass:

key-password-logo

LastPass

LastPass

There are various alternatives for Keepass for other operating systems, but for Linux the number of variants is reduced. One of the most interesting alternatives for KeepassX is LastPass. LastPass can be installed on various platforms, plus an add-on is available for Google's Chrome, Mozilla Firefox, and Opera browsers.

LastPass manages passwords in the cloud, and its operation is the same as KeepassX, in which you only need to remember a master password to manage the rest of the passwords. Passwords will be locally encrypted and synced to supported browsers to access accounts.

LastPass has a free version which works quite well, although the paid version has certain advantages over this one. The price of the service is $ 1 per month, so you will have access to new features of the Premium version.

encrypt

Main web Encryptr

Another alternative is another alternative to LastPass and Keepass. Encryptr is a cloud-based password manager. It is available for various platforms, including Android and for Linux distributions. In this case it is a totally free and free alternative, something that does not happen with LastPass.

Encryptr encrypts and decrypts passwords locally with a master password, therefore its behavior is the same as its brothers described above. Encrypted information can be stored in the cloud and synced between your device and it to always have passwords wherever you are.

Do not forget to comment, leave your doubts, criticisms or suggestions ...


A comment, leave yours

Leave a Comment

Your email address will not be published. Required fields are marked with *

*

*

  1. Responsible for the data: AB Internet Networks 2008 SL
  2. Purpose of the data: Control SPAM, comment management.
  3. Legitimation: Your consent
  4. Communication of the data: The data will not be communicated to third parties except by legal obligation.
  5. Data storage: Database hosted by Occentus Networks (EU)
  6. Rights: At any time you can limit, recover and delete your information.

  1.   duncan said

    sudo apt-get install keepassx ...

    KeeFox *