Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MitM Attack against KeePass 2’s Update Check

bogner.sh

Post reply on HN
Print view View original

31–40 of 78 posts

Re: MitM Attack against KeePass 2’s Update Check

#31

Post by RRRA »

nwah1 wrote: post #8

I was always skeptical of KeePass which is why I've been using KeePassX. It is just a simple Qt app. Unfortunately there is no KeePassHttp support yet, so you can't hook it up to your browser, but there is a fork available with full support. https://github.com/droidmonkey/keepassx_http/

And KeepassX also supports version 2 and is MUCH lighter. :)

Re: MitM Attack against KeePass 2’s Update Check

#32

Post by Ensorceled »

jbob2000 wrote: post #2

It's free software; You have no right to complain or dictate priorities when you aren't paying for it. You aren't the customer, KeePass 2 advertisers are. Use 1password and pay $5 a month if you want the right to complain.

What "complaint" are you talking about? The blog is an objective explanation of a CVE along with explicit suggestions to the author and an discussion on how to protect yourself if you're a user.

Re: MitM Attack against KeePass 2’s Update Check

#33

Post by AjithAntony »

eightysix_four wrote: post #29
jackson_1 wrote: post #21

The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution This doesn't entirely make sense. I'm sure it's possible to serve adverts on a HTTPS page, and let's encrypt is hardly expensive

> I'm sure it's possible to serve adverts on a HTTPS page Yes, you can, but you lose a tremendous amount of ad revenue and a number of ad providers still don't support HTTPS.

Is this becuase all the third party assets and scripts would need to be HTTPS as well? If they weren't then you get that browser warning about mixed content?

Re: MitM Attack against KeePass 2’s Update Check

#34

Post by cyphar »

jbob2000 wrote: post #2

It's free software; You have no right to complain or dictate priorities when you aren't paying for it. You aren't the customer, KeePass 2 advertisers are. Use 1password and pay $5 a month if you want the right to complain.

> It's free software;

It is not free software, it's proprietary. Please don't use the phrase "free software" in this context, as it confuses people. It has a very specific meaning in the context of software.

Re: MitM Attack against KeePass 2’s Update Check

#35

Post by Zuider »

the_af wrote: post #28
alyandon wrote: post #13

Earlier quoted context omitted.

I'd probably switch to KeePassX instead of running KeePass in wine if the password generator were as flexible.

Why are you running KeePass in wine?

That could make sense OP dual-booted and the KeePass app and database were installed on the NTFS partition.

Re: MitM Attack against KeePass 2’s Update Check

#37

Post by alyandon »

the_af wrote: post #28
alyandon wrote: post #13

Earlier quoted context omitted.

I'd probably switch to KeePassX instead of running KeePass in wine if the password generator were as flexible.

Why are you running KeePass in wine?

I have very complex password generation requirements for some of the services I need to access and KeePassX does not:

    1) have nearly the same level of support for defining complex password generation rules
    2) have support for saving said custom password generation as a profile
So, KeePass + wine it is until I have a better alternative. :)

Re: MitM Attack against KeePass 2’s Update Check

#39

Post by alyandon »

Zuider wrote: post #35
the_af wrote: post #28

Earlier quoted context omitted.

Why are you running KeePass in wine?

That could make sense OP dual-booted and the KeePass app and database were installed on the NTFS partition.

Currently, no - but I have actually used a setup like that before.

Re: MitM Attack against KeePass 2’s Update Check

#40

Post by mhurron »

cyphar wrote: post #34
jbob2000 wrote: post #2

It's free software; You have no right to complain or dictate priorities when you aren't paying for it. You aren't the customer, KeePass 2 advertisers are. Use 1password and pay $5 a month if you want the right to complain.

> It's free software; It is not free software, it's proprietary. Please don't use the phrase "free software" in this context, as it confuses people. It has a very specific meaning in the context of software.

Even in the context of software, it still means no cost.

In the context of software it can also mean FOSS, but just because we're talking about software doesn't mean we suddenly lose the 'no cost' meaning.

Post reply on HN