1

I've been very satisfied with 'keeper' but the $40/year seems bit much. Any recommendations for an alternative on android? Requirements:

  1. Secure (of course)
  2. Master password with fingerprint support
  3. Free as in beer (under 10/year is acceptable)
  4. Cloud backup
  5. Support on windows 10 desktop is a good to have.
Improve this question

3 Answers 3

Reset to default
1

Keepass2Android meets all your requirements, free, fingerprint support, Open Source, compatible with Keepass desktop app, cloud sync and the list goes on....

Improve this answer
5
  • 1
    I would be somewhat careful about the quick unlock feature - that looks dangerous to me. Also, looking at the play store page, I don't see finger print scanner support listed. How does that work?
    – Michael Kohne
    Commented Feb 2, 2017 at 14:36
  • It's definitely in there as I just used my fingerprint to go get the password for this site. It uses the very latest encryption protocols like argon2. So it's very safe
    – boxa72_dev
    Commented Feb 2, 2017 at 14:52
  • Overall, Keepass is definitely very safe. But that quick unlock feature looks funny to me. To implement, they'd either have to keep your password around, or keep part of your password (to match against) and keep the DB decrypted. Both of which significantly weaken the protections provided by the encryption inherent in Keepass.
    – Michael Kohne
    Commented Feb 2, 2017 at 15:20
  • Why don't you ask Philip Crocoll how he implements it? Ironically I'm just now learning encryption in Computer Science so I'll be able to tell you myself in about a week but my guess is he hashes it and then reverses it when you use the quick open feature. If it's just sitting their in plaintext I agree that's dangerous!
    – boxa72_dev
    Commented Feb 2, 2017 at 21:48
  • @MichaelKohne Doing it smartly would be to implement a Key Encryption Key (KEK) and encrypt two copes of the KEK: Each copy then gets encrypted with their own keys, which are generated by a Key Derivation Function (KDF). One copy gets encrypted with a KDF based on the password, and the other uses a KDF based on the fingerprint. That way, neither the database password nor the fingerprint need to actually be stored. Please note though, this is just speculation. As boxa suggests, asking the dev would be best. Alternately, maybe try Information Security.
    – Iszi
    Commented Apr 27, 2017 at 20:42
0

My suggestion would be to try using keepass2. Its open source and you can set it up to sync over the cloud. Unfortunately it doesn't include finger-scan support. (Although in my opinion, if you want to be really safe this is a good thing to not have enabled.)

Improve this answer
0

I personally use KeePassDroid, with the database on my Dropbox, syncronized to my phone & tablet via DropSync.

That combo works great for me, but it lacks fingerprint support.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.