Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC Debian maintainer has removed all network features

fosstodon.org

Post reply on HN
Print view View original

341–350 of 367 posts

Re: KeePassXC Debian maintainer has removed all network features

#341

Post by kasabali »

bdd8f1df777b wrote: post #234
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

I see this kind of mindset often--if we remove the features useful but not perfectly secure from users, we can protect them from such insecurity. But this mindset is wrong. What happens instead is that users will fulfill their needs in even more insecure ways.

Which more insecure ways? At worst they can install the keepassxc-full package and back to exactly where they were. This isn't tyranny, maintainer has provided a choice.

Re: KeePassXC Debian maintainer has removed all network features

#342

Post by kasabali »

willywanker wrote: post #330

I see in this an attitude that's become increasingly common since the 2010s among developers as well as software companies regardless of open source or proprietary - "We know what's good for you, the end user and we will decide on your behalf." and use this as an excuse to strip out features that had been long available. Firefox is a classic example. In stark contrast to the previous norm of highly customizable softw…

That's a very misleading comparison. When Mozilla (upstream) axes a feature, it's gone permanently and you can't get it back.

Which is not the case here at all, here downstream turns off a feature in the default build, while simultaneously providing the fully featured version in a just as easily installable package.

Re: KeePassXC Debian maintainer has removed all network features

#343

Post by redeeman »

bananenpubs wrote: post #78
Dah00n wrote: post #51

Earlier quoted context omitted.

They didn't "gut what upstream built". He published it without plugins and made a -full version that include plugins. If plugins are plugged in as default it isn't a plugin but a built-in feature. This is the correct way.

He published it w/o core package functionality. There are no plugins with KXC, that is one of their main arguments: don't rely on 3rd party code, bring it all inhouse, where it can be checked / maintained.

as others said, core functionality that UPSTREAM THEMSELVES decided not to include in default/recommended build instructions?

Re: KeePassXC Debian maintainer has removed all network features

#344

Post by redeeman »

zer00eyz wrote: post #104
alyandon wrote: post #27

Gutting the functionality that upstream has built into a piece of software and then publishing it under the same name is dubious at best. If they want to go this direction they should publish as a fork under a different name so upstream doesn't get constantly barraged by complaints of users having issues. This reminds me of the time years ago when the Debian maintainer of Chromium decided to unilaterally disable the…

IF apple said "hey we edited your app because we think its more secure"... People would have torches and pitchforks out. But a deb maintainer does it and there is debate? If there was a security issue then the insecure version should NOT be available. But again this is not the case. In an App Store world, the role of mainainter has to change. The job is to make the software work with the distro, not keep the name and…

flipping build switches that upstream provided is "edited your app" ??

Re: KeePassXC Debian maintainer has removed all network features

#345

Post by redserk »

kasabali wrote: post #340
jdbernard wrote: post #292

Earlier quoted context omitted.

The fact that they are customizing the software is not really the issue. The issue is that they are making a change that will remove significant functionality and in some cases completely lock some users out of their password database, which is a huge deal. Imagine if you wake up tomorrow, run a software update and then can't log in to your bank? I imagine the reason this has blown up so much is that the maintainer n…

> Imagine if you wake up tomorrow, run a software update and then can't log in to your bank Oh, the horror of being in unstable/testing channel and ignoring the change notice which has been shown automatically during apt-get upgrade.

The snark here is unnecessary and completely disconnected from how people use these systems in the real world.

Deferring to “it’s in the notes!” means nothing if you have more than a handful of packages on your machine.

You should also clarify the assertion that packaging affecting testing target won’t eventually hit stable, because that would be a major change that I haven’t heard about.

An end user will get impacted by this eventually.

Re: KeePassXC Debian maintainer has removed all network features

#346

Post by 0x_rs »

redeeman wrote: post #343
bananenpubs wrote: post #78

Earlier quoted context omitted.

He published it w/o core package functionality. There are no plugins with KXC, that is one of their main arguments: don't rely on 3rd party code, bring it all inhouse, where it can be checked / maintained.

as others said, core functionality that UPSTREAM THEMSELVES decided not to include in default/recommended build instructions?

>UPSTREAM THEMSELVES decided not to include in default/recommended build instructions

This is false, or at the very least misleading. It doesn't take much to go on the repository and give a closer look instead of repeating "what other said". Kwpolska already wrote it in this thread, -DWITH_XC_ALL (the flag that's been turned OFF in the original Debian package rules) is explicitly called in the build instructions, and not only there but also one release tool [1] and snap config [2]. This is merely how the project manages its build configuration, with specific flags turned off and one master toggle enabled by default (or expected to be passed to cmake/bash release tool). Same thing for the ppa packaging. [3]

0. https://github.com/keepassxreboot/keepassxc/blob/develop/INS...

1. https://github.com/keepassxreboot/keepassxc/blob/da90319d2d0...

2. https://github.com/keepassxreboot/keepassxc/blob/da90319d2d0...

3. https://github.com/keepassxreboot/keepassxc-packaging/blob/9...

Re: KeePassXC Debian maintainer has removed all network features

#347

Post by guilhas »

valicord wrote: post #316
guilhas wrote: post #309

Earlier quoted context omitted.

If the yubikey stops working, you also loose access to the database So I would have a backup with a simple password, or even unencrypted in a USB somewhere

You backup the yubikey seed (whatever it's called) separately from the password db, so that the attacker still has to get 3 separate pieces of information (db, password, seed) to get the full access.

If you backup the "seed" hotp secret you can probably use any OTP client software to open the DB without needing the yubikey

Re: KeePassXC Debian maintainer has removed all network features

#348

Post by Liskni_si »

jeffalyanak wrote: post #46

I think the solution suggested by drawks seems clearly the correct choice: > I think the proper solution would probably be to package both a "-full" and "-minimal" version of the software and utilize Debian package meta-data fields to define a Conflicts relationship between the packages and tag them also both with a Provides for keepassxc and also add a tag Replaces: keepassxc to the -full build so that during a pack…

It not only _is_ the obvious choice, it is _exactly_ what has actually happened in Debian: https://salsa.debian.org/debian/keepassxc/-/commit/7d6d16e3f...

The original post is just a badly written clickbait. Nothing was removed, it was just moved to the keepassxc-full package.

Re: KeePassXC Debian maintainer has removed all network features

#349

Post by jeffalyanak »

Liskni_si wrote: post #348
jeffalyanak wrote: post #46

I think the solution suggested by drawks seems clearly the correct choice: > I think the proper solution would probably be to package both a "-full" and "-minimal" version of the software and utilize Debian package meta-data fields to define a Conflicts relationship between the packages and tag them also both with a Provides for keepassxc and also add a tag Replaces: keepassxc to the -full build so that during a pack…

It not only _is_ the obvious choice, it is _exactly_ what has actually happened in Debian: https://salsa.debian.org/debian/keepassxc/-/commit/7d6d16e3f... The original post is just a badly written clickbait. Nothing was removed, it was just moved to the keepassxc-full package.

I don't believe you're correct. It seems like the option that Debian decided on _will_ remove those features for users who are upgrading a package.

Users who already have the keypassxc package will need to explicitly switch packages if they want the full one. That's not the same behaviour as described in my quote comment.

Re: KeePassXC Debian maintainer has removed all network features

#350

Post by acters »

arp242 wrote: post #58
theamk wrote: post #15

Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes / exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1]. Remember, the full n…

Lots of things are a huge potential hole and/or exploit entry point. Lots of these things are also useful. And "being useful" can increase security because if password managers are hard to use then people stop using them. And looking at this a bit more, it's not clear to me that using the clipboard is necessarily more secure than the browser integration. Copy/paste accidents alone would offset quite a bit of the secu…

I fully agree with you. I wish people would stop focusing heavily on how removing features can potentially decrease attacks. Especially when those exact features are used to prevent the WORST possible attack vector, a mishandled or exploited Clipboard. I do not see how else would a user be able to gain access to the passwords without either using the keyboard, or opening the edit dialogue to select "show password" which would just make them plain-text and MUCH easier to attack. These features were introduced to not only offer ease of use, but to facilitate a more secure method of transferring the password to the desired location. These maintainers clearly did NOT think these things through and potentially created a much less secure package than intended.
Post reply on HN