6 ms·
KeePassXC 2.4.3
- jeltz 7y agoWhile I love KeePassXC this is just a minor bug fix release.
- Lendal 7y agoIt is, but the 2.4 release introduced integrated updates. I was still on 2.3 and wasn't aware of this, or that my KeePass was out of date until I saw this this morning. So I am thankful for the heads up. :)
- ComodoHacker 7y agoKeePassXC still lacks in-memory protection, so I stay with KeePass, with all its .NET troubles.
- _red 7y agoCan elaborate more on the practical benefits of encrypted memory? Presumably this is mainly good for multi-user systems? On the average single-user system it seems that if you can already read memory there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc).
- gruez 7y agoAFAIK the only thing it protects you from is generic malware that scans process memory for passwords. It’s trivial to bypass though: all you need to do is patch the code as it’s running to dump all the plaintext entries for you. > there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc). Keepass has mitigations for those as well.
- masklinn 7y ago> AFAIK the only thing it protects you from is generic malware that scans process memory for passwords. Apparently it doesn't even do that: https://www.securityevaluators.com/casestudies/password-manager-hacking/ https://www.securityevaluators.com/casestudies/password-mana... (section Keepass) Possibly because keepass uses the wrong flag? https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.memoryprotectionscope https://docs.microsoft.com/en-us/dotnet/api/system.security.... seems to say that the memory segment can be decrypted by either: * all processes running on the box * all processes owned by the same user * only this process Alternatively, might be because C# and the memory protection primitives don't prevent the GC from copying its data out of the protected area? IDK edit: ah, or they might be using ProtectedData rather than ProtectedMemory, that only has the "same machine" and "same user" levels of protection: https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.dataprotectionscope https://docs.microsoft.com/en-us/dotnet/api/system.security....
- SamuelAdams 7y agoCrash reports often include memory dumps. Firefox automatically reports these to Mozilla - there's plenty of other software that auto-reports crash data as well. If that crash data includes in-memory credentials, that could lead to your master password being compromised.
- 292355744930110 7y agoKeepassXC disables core dumps[0]. [0] https://github.com/keepassxreboot/keepassxc/issues/2718#issuecomment-466160954 https://github.com/keepassxreboot/keepassxc/issues/2718#issu...
- blattimwind 7y ago> Crash reports often include memory dumps. Firefox automatically reports these to Mozilla Of the process in question, not the entire system. A Firefox crash dump can potentially still include credentials and private keys, of course.
- antongribok 7y agoI thought that it did now. For example this PR: https://github.com/keepassxreboot/keepassxc/pull/3020 https://github.com/keepassxreboot/keepassxc/pull/3020 Edit: Also, see this PR: https://github.com/keepassxreboot/keepassxc/pull/371 https://github.com/keepassxreboot/keepassxc/pull/371
- masklinn 7y agohttps://github.com/keepassxreboot/keepassxc/issues/2718#issuecomment-466160954 https://github.com/keepassxreboot/keepassxc/issues/2718#issu... I'd guess it's this one: > KeePassXC also cannot prevent data extraction from a hibernation file which stores your computer's memory to disk when going to sleep. KeePass uses DPAPI so password-storage memory is not written to swap (and I guess hibernatefile) in cleartext. Note that this doesn't protect against reading the memory directly[0]. Though (on unices) it doesn't mention mlock(2) either. [0] https://www.securityevaluators.com/casestudies/password-manager-hacking/ https://www.securityevaluators.com/casestudies/password-mana... subsection "Exposure of Cleartext Entries in Memory" of the Keepass section
- ComodoHacker 7y agoThanks for pointing out. Nice to see progress in this direction.
- vbezhenar 7y agoWhat troubles? I recently started to use it, and so far I did not encounter any troubles. For me the killer feature of KeePass is that it allows me to safely use it without typing master password using -pw-enc command line argument. I hated to type my password every day over and over again with 1Password. Especially because I understand that it's very weak protection if someone already break in my computer.
- butteroverflow 7y agoI reckon OP dislikes the need to have the whole Mono runtime to run one small-ish application. At least that's the reason I always preferred the native ports.
- vbezhenar 7y agoAh, I'm Windows user, I didn't even know that you could run KeePass on non-Windows systems.
- blattimwind 7y ago> without typing master password using -pw-enc command line argument Process command lines are world-readable on various operating systems, so passing passwords over them is generally not a good idea.
- vbezhenar 7y agoIt's not a clear text password. It's encrypted with Windows user credentials. If someone just steals it, it won't be useful by itself.
- deleted 7y ago[deleted]
- phoerious 7y ago(Full disclosure: I contribute to KeePassXC) In fact, KeePassXC has shown to have better memory protection than KeePass: https://keepassxc.org/blog/2019-02-21-memory-security/ https://keepassxc.org/blog/2019-02-21-memory-security/ (note the article is from February, some things have changed since then, see below). The only thing we do not have at the moment is in-memory encryption. We do, however implement the following security measures on all platforms: - prevent swapping of master key hashes (using gcry_malloc_secure) - prevent non-root / admin access to our process memory (KeePass does NOT have this) - overwrite all dynamically allocated memory with zeros on free - disable any kind of coredump or crash reporting A patch for in-memory encryption is being worked on, but needs further testing before it can be merged: https://github.com/keepassxreboot/keepassxc/pull/3055 https://github.com/keepassxreboot/keepassxc/pull/3055 Please note that this still cannot fully prevent swapping out of secrets. As soon as things are to be displayed somewhere in the GUI, they are basically out of our hands. We also cannot fully protect everything while the database is being loaded or written. However, the same applies to KeePass. There is just too much going on with memory management on modern operating systems.
- ComodoHacker 7y agoThank you. You convinced me to try KeePassXC again.
- giancarlostoro 7y agoBeen using BitWarden since I stopped using LastPass (lost my 10 year old vault) anybody know of any good reviews of all the different types of password managers that go into the security flaws / considerations?
- kekebo 7y agoThere are a couple of recent posts / discussions on HN regarding the topic: https://hn.algolia.com/?query=password%20manager&sort=byPopularity&prefix=false&page=0&dateRange=pastYear&type=story https://hn.algolia.com/?query=password%20manager&sort=byPopu...
- dexterdog 7y agoI switched from Lastpass to Bitwarden about a year ago as well. I have no complaints except for a few minor UX annoyances in the firefox add-on.
- Jonnax 7y agoI was only aware of Keepass itself. What are the differences between KeypassXC, KeepassX and Keepass?
- mrrsm 7y agoKeePass is the original project. It is an open source dotnet application. The source code, as of the last time I checked, is released as a tar/zip with the binaries only. KeePassX is an open source c++ application. It was one of the cross platform applications to manage KeePass databases. It has not been under very active development for a while. KeePassXC is a fork of KeePassX which is under active developement. They have added many features and improvements and has stayed up to date with kdbx updates.
- sebazzz 7y agoIs KeePassXC also audited? The main KeePass has had multiple security audits, also thanks to the EU who funded it one time. Seems relevant for a password manager.
- jbj 7y agoThere is still an active KeePass bug bounty from the european commission: https://www.intigriti.com/public/project/keepass/keepassbyec https://www.intigriti.com/public/project/keepass/keepassbyec
- ASalazarMX 7y agoWhile I like KeePassXC more, this is even more relevant as KeePassXC is made in C++, while Keepass is made in C#. C++ makes it easier to shoot yourself in the foot. It hasn't: https://keepassxc.org/docs/#faq-audit https://keepassxc.org/docs/#faq-audit
- packet_nerd 7y agoKeePassXC is fantastic, I especially like the good Yubikey integration. The one small feature I miss from the original KeePass was the password templates. I like all my passwords to follow a grouped pattern so its easier to type into a phone or something while still being strong.
- diehunde 7y agoIs it possible to sync your passwords with other devices?
- ativzzz 7y agoYes, you can store the database file in a shared drive (not sure that's proper security though)
- ufo 7y agoThat is secure as long as you have a good master password
- packet_nerd 7y agoKeePassXC works really well with Yubikey too. I use a Yubikey and a short pin for the password.
- sexydefinesher 7y agoYou can use a combination of a password to together with a key stored locally on all devices
- Tepix 7y agoYou can use password protection on the drive as well as IP restrictions. You could even offer the drive only in your home network on your NAS.
- diehunde 7y agoBut how do you read the passwords from let's say iOS ? I don't see any iOS client on the website. Thanks.
- ativzzz 7y agoYou need to download an app. Search keepass on ios (I use android so I can't recommend one to you). They won't be made by the same people, but they can use the same password database
- koolba 7y agoAnybody know if they've fixed (or plan to fix) the sort by latest modification date of all records? That was the one missing feature from going from KeePassX to KeePassXC.
- noisy_boy 7y agoI am able to sort by latest modification date (not sure if thats what you meant).
- alexnewman 7y agoWhy should I switch from pass (git+pgp) to keepassx ?What's one feature in keepassx nto in pass/passx
- ufo 7y agoFor me the biggest difference is that you have a single encrypted database file, and that no metadata is stored unencrypted. By default, pass uses file names as keys, so website names are stored in the clear. (To fix this on pass.you need to use pass-tomb, which I found very clunky, and could never get working quite right) Another thing I like about keepassxc is that it has lots of features. It comes with a flexible passwird generator, has a friendly GUI UI, can be integrated to the web browser using an extension, and there are compatible android apps you can use on your phone.
- benoliver999 7y agoI agree about the metadata. I like pass but it's a flaw for sure. At least it's upfront about it. Most other issues are covered with pass, like a good android app etc etc.
- elagost 7y agoYou could always use pass-tomb, which is an extension that stores the entire tree encrypted. https://github.com/roddhjav/pass-tomb#readme https://github.com/roddhjav/pass-tomb#readme
- ufo 7y agoAs I mentioned further up, pass tomb needs to be installed separately (which is not trivial depending on your distro) and is clunky to use. AFAIK it also cannot be used to encrypt the password database on Android. It also really bugs me that an important security feature like this one is not the default.
- alexnewman 7y ago
- theandrewbailey 7y agoI switched to KeePassXC a few months ago (from KeePass). It was a no brainer when I noticed that I didn't need plugins anymore, since SSH keys, TOTP, and browser integration came out of the box.
- amaccuish 7y agoAnyone got any good recommendations for an iOS client. I've just moved from android and there's several but not sure which to pick, which are opensource etc.
- varjolintu 7y agoStrongbox is the best one right now. It supports KDBX 4, while older minikeepass doesn't.
- amaccuish 7y agoYe I'm using that right now but 25.99 GBP is a lot for me as a student. I know software development isn't free, don't mind paying say 10, but 25.99 is quite a stretch for me :(
- ws66 7y agoI use KyPass on iOS and I am happy with it. I think it is 6$ on the app store.
- mieses 7y agohttps://github.com/MiniKeePass/MiniKeePass https://github.com/MiniKeePass/MiniKeePass it's very basic but it works. if you keep the kdbx file in cloud storage, you can use iOS "open with" to open in MiniKeePass.
- mieses 7y agoI switched from KeePass to KeeWeb because of the user interface and Google Drive integration. KeeWeb is an open source cross platform Electron app.