How to use KeePass (and why!)

Hi! I'm aetherspoon and I want YOU to use a password manager!... so I'm going to bore you for an hour as to why. There are chapter markers in this, and most of the details are for exactly how to set up KeePass; if you're looking at "why a password manager?", that's the last section. :)

Please take note, while I AM a security professional I'm not YOUR security professional. This isn't an exhaustive list of things you should do and everyone's situations are a little different - meaning that KeePass might not be the right tool for your situation. I just think it is a right tool for most people's situations.

Chapters:
00:00:00 - Introduction
00:00:30 - Who am I and why should you listen?
00:01:20 - LastPass News
00:03:33 - Installing KeePass
00:05:54 - Boo Kitty
00:06:19 - New KeePass Database
00:13:49 - KeePass - Welcome to the UI
00:17:33 - KeePass Password Generator
00:18:37 - Other KeePass Entry Options
00:21:17 - Other KeePass Features
00:28:18 - KeePass HTTP - The Only Plugin You Need
00:32:48 - KeePass Browser Addons - Chromium Edge
00:35:30 - KeePass HTTP in action
00:39:15 - KeePass Browser Addons - Firefox
00:43:46 - KeePass Imports - Brief Mention
00:44:48 - Security and Trust - Why KeePass?
00:50:25 - KeePass In The Cloud?
00:54:53 - Why a password manager?

[coweatsman]

I have used Keepass for years and like the user customisation aspect of it even as it does not have all the features of other PMs. I also save licence info to keepass in dummy account entries. It would be an improvement if KP added dedicated entry types which could also be referenced by added fields in other entries, like credit card info. I have my entries in quite a few different folders for different purposes, like newspapers, entertainment, utilities etc. I do not have autosave as exiting without saving is a great easy way of reversing a mistake. That is the great part of KP, being able to set your own options and policies which might not suit other people. For example I have different preferences to aetherspoon. I am watching this video because there are always things I still do not know about KP.

[Mightydoggo]

Thanks for the thorough tut! Had to redo my entire setup lately due to being lazy and getting slapped for it. Now I´m doing it _right_ (password manager, veracrypt, etc) at least as far as it is still convenient enough for everyday use.

Windows 11 sux indeed. The sheer amount of telemetry alone gives me nightmares. Only time I touch it is for certain games that just refuse to work with superior OSs.

BTW Your cat is super cute!

[ricardsonwilliams]

very good! thank you far sharing, I just setup today using your video.

[ricardsonwilliams]

also nice to have a new video how to use OTP/2FA with keepass.

[sashanan]

1) Hah! They made any hack a GameFAQs moderator back then! Didn't Groucho Marx say he didn't care to join any club that would have him as a member?
2) I *had* plans for Christmas Eve, but COVID-19 decided differently. Takes just one person in the party to get infected and the whole plan is delayed or cancelled. I was home alone, therefore. As with the rest of Christmas. New Year's Eve still pending.
3) Although I have fewer passwords than you, I have well more than the average human brain can hold and reproduce, and I do use unique and long passwords. So I password manage also.
4) NeoPets? There's a password I don't remember, or can reset, as I don't have access to (or even remember) whatever e-mail address I used.

[christopherexline]

Yes to a video on how to set up NextCloud

[JulioAldana]

What are your thoughts on BitWarden that’s also open-source but is a cloud password service?

[TheSocratesian]

What is the difference between KeepassXC and Keepassium? I'm running a Macbook Pro and iPhone and want to sync the database between devices.

[mar-tin]

Which one is better keepass or keepassxc?

[AlthenaLuna]

1. Oh, GameFAQs. What a strange presence you've been in our lives.
2. How am I? Upright. Caffeinating. Watching you computer nerd at me for an hour. Trying to remember the particular issues I had when I tried a password manager and ended up chucking it fairly immediately because the UI/management was clunky/exhausting/etc..
3. Boo kitty!
4. Ah, one of the things I've been wondering if you'd touch on - the 'expires in 90 days' passwords. The places that force that also tend to have a "must not be one of your previous 8 (or however many) passwords"...which SEEM like they're meant to force better account security but actually end up exhausting people into worse practices. And - even without the risk of database rollback scenario you mention - now we have to store all of those previous passwords so we know there's no duplication. I hate them.
5. Yes, importing all of my fucking logins and passwords FROM my browsers (yes, yes, you get to that rant, I know) was nice and easy. THAT was the main barrier to entry that failed with the one I'd tried some time back. Having to input all of those manually one by one was a deal breaker. IF there was a way to do it, it was so obtuse and unclear that the hassle in figuring out how was still a problem.
6. I hate "The Cloud". See also internet of (shit) things. They're dragging that fucking trash into cars, and not just as bells and/or whistles to opt into...UGH.
7. Sure. Talk nerdy to us about your self-hosted setup.
8. I am somebody!
9. And THERE'S the other thing I'd been waiting to see if you'd touch on - having logins and passwords stored in/by your browsers. I figured you'd get there, but you really waited until the end.

[davidmoore]

Hey dude, thanks for the amazing video! What do you thing about keepass xc? it has an addon that is not third party, maybe is a little bit more secure?

[Jona]

As a security engineer:
Do you have any recommendations for android? Or do you use it only on your computer?

[EricS-ufmv]

As a long time Keepass user, this is a good overall tutorial. But my 2cents is to avoid the browser plugins. The Keepass project itself is opensource and probably vetting by loads of devs. But the individual add-ons and PARTICULARLY the web browser extensions are NOT WRITTEN or vetted by the Keepass lead dev Dominik. These Chrome/Edge/FF plugins are simply random bits of code written by basically anonymous coders. Literally anyone can write a plugin and submit it to the store. And these plug ins can do anything... they're literally reaching into your DB and plucking out PW's (as they must to function), but who's to say that plug-in can't also http POST that data to some random server somewhere. I'm not a tinfoil hat guy... but honestly, you're literally at the whim of some random kid on the internet who authored that plugin... they can push an update anytime they want and change that plugin's functionality.

[decebal]

Thank you very much, I will delete my lasspass account.

[the-papaw]

Good video, but I prefer KeePassXC. Almost the same, but better IMO