KeePassXC Debian maintainer has removed all network features

Post by lawn » Fri, May 10, 2024, 7:54 PM UTC

undersuit wrote: post #156

cycomanic wrote: post #143

Earlier quoted context omitted.

The justification is absolute rubbish. I The argument is that it reduces attack surface, but compared to what, the alternative to including the yubikey code is not using a yubikey, which reduces security. The alternative to using the browser integration (or the ssh agent) is to use the clipboard, which is likely more code and definitely less vetted code. By the same argument we should remove encryption as well, becau…

>the alternative to including the yubikey code is not using a yubikey, which reduces security. The physics of someone cracking my passphrase and the physics of someone cracking my Yubikey are both in the boil the oceans amount of energy. I'm fine not letting a usb device masquerading as a keyboard have access to my password database. Remember: "When you lose your YubiKey or someone else gets access to it, your databa…

Post by workethics » Fri, May 10, 2024, 7:55 PM UTC

DDiggler wrote: post #134

Meanwhile in Arch land (possibly other distros as well), the fwupd package (which I imagine to be a fairly common package to be installed among the user base) has been silently configured to depend on passim, which spins up an open web server on 0.0.0.0:27500[1] without any(!) explicit user consent whatsover. Passim then uses GnuTLS, which is famous for containing more holes than Swiss cheese [2][3]. Absolutely insan…

Post by joeyh » Fri, May 10, 2024, 8:30 PM UTC

yjftsjthsd-h wrote: post #123

cjk2 wrote: post #82

Earlier quoted context omitted.

It's not completely different. They patched stuff out. And I, as an end user, am absolutely fine with that, as a user of vim-nox package etc etc...

But vim-nox is a separate package with a clear name saying that it's got X removed; I don't think this would be nearly as controversial if they'd shipped a keepassxc-nonetwork package.

Post by valicord » Fri, May 10, 2024, 8:37 PM UTC

undersuit wrote: post #156

cycomanic wrote: post #143

Earlier quoted context omitted.

The justification is absolute rubbish. I The argument is that it reduces attack surface, but compared to what, the alternative to including the yubikey code is not using a yubikey, which reduces security. The alternative to using the browser integration (or the ssh agent) is to use the clipboard, which is likely more code and definitely less vetted code. By the same argument we should remove encryption as well, becau…

>the alternative to including the yubikey code is not using a yubikey, which reduces security. The physics of someone cracking my passphrase and the physics of someone cracking my Yubikey are both in the boil the oceans amount of energy. I'm fine not letting a usb device masquerading as a keyboard have access to my password database. Remember: "When you lose your YubiKey or someone else gets access to it, your databa…

Post by yjftsjthsd-h » Fri, May 10, 2024, 8:57 PM UTC

joeyh wrote: post #165

yjftsjthsd-h wrote: post #123

Earlier quoted context omitted.

But vim-nox is a separate package with a clear name saying that it's got X removed; I don't think this would be nearly as controversial if they'd shipped a keepassxc-nonetwork package.

vim-tiny is installed by default on debian (providing a vim command), and also has X removed.