Can a browser and keepass both be run in flatpak and work?
from InternetCitizen2@lemmy.world to linux@lemmy.ml on 11 Jun 23:52
https://lemmy.world/post/16433842

Hey all!

(I did post this in c/flatpak, but this community is more active. I am not sure where would be more appropriate)

Something that I have been wanting to get working is having my browser and password manager both in flatpak. I really like being sandbox and having faster updates if the distro is on the slower side perhaps.

I have a set up with Firefox as a deb and keepassxc as a flat and that works find as one would expect. I did want to install Vivaldi as a flatpak and was not able to get it to talk with keepass.

In my reading I found this: installing KeePassXC natively, which you’d actually want for security reasons.

installing KeePassXC natively, which you’d actually want for security reasons

What is mean by that line of reasoning?

#linux

threaded - newest

arality@programming.dev on 12 Jun 00:52 next collapse

Could it be that it just introduces additional attack vectors?

InternetCitizen2@lemmy.world on 12 Jun 01:18 collapse

Perhaps. In my distro of choice (popOS) the flatpak is a bit ahead of the repo version. I feel that having the bug fixes and only being able to interact with keepass via the sandbox would limit the attacks. I am not an expert on security, so i would like to hear where my current ideas fail.

ozymandias117@lemmy.world on 12 Jun 01:01 next collapse

They’re saying that it only works if your browser is installed natively and your password manager is sandboxed, which is the exact opposite of what you’d want

The browser is the vulnerable software that needs sandboxing

Both being sandboxed would be fine, too

InternetCitizen2@lemmy.world on 12 Jun 01:35 next collapse

Thank you for clarifying that.

aport@programming.dev on 12 Jun 04:19 collapse

I don’t know if this is still the case, but IIRC browsers (chrome and Firefox) have their own sandboxing which is quite effective, but their efficacy is hindered by flatpak.

thayer@lemmy.ca on 12 Jun 04:04 next collapse

I run the flatpak versions of KeepassXC and Firefox. In order to enable auto-type, I disable Wayland for both apps via Flatseal (enabling fallback to X11). Works fine in KDE and GNOME, though GNOME now prompts to share the display once per session…something to do with how the portals work now.

federalreverse@feddit.de on 12 Jun 07:17 collapse

X11 is not made with security in mind. At the point where you disable Wayland, you can basically use native apps rather than flatpaked apps.

thayer@lemmy.ca on 12 Jun 07:56 collapse

Oh I’m well aware of X11’s shortcomings, and it’s a band-aid fix until Wayland and/or the DEs sort these capabilities out. If that day doesn’t come within the next year or so, I’ll consider other options then.

boredsquirrel@slrpnk.net on 12 Jun 10:17 next collapse

discussion.fedoraproject.org/t/82062

boredsquirrel@slrpnk.net on 12 Jun 10:22 collapse

works fine as one would expect. Not that self explanatory, I wonder how

install Vivaldi as a flatpak and was not able to get it to talk with keepass.

No the native messaging portal is missing

What is mean by that line of reasoning?

Makes no sense. The Flatpak is official and more isolated than native packages. Reduce the number of system apps as much as possible.

See my thread on the methods but they are all hacky. You could copy the KeepassXC binary to the Browser flatpak container and launch it from there. But this needs to be repeated on every update, but it is possible and can be automated.