Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass – questionable security

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 231 posts

Re: KeePass – questionable security

#91

Post by tptacek »

sdrapkin wrote: post #83
tptacek wrote: post #76

Earlier quoted context omitted.

I use and like 1Password.

Please remember that just because tptacek likes and uses something, do not mean that it has great security. The PDF linked below states that there is zero integrity in 1Password file format. I happen to like and use KeePass, but that is not a secure-software guarantee.

I agree with your first sentence. But, regarding the rest of your comment:

We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption.

https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do...

Members of the 1Password team are vocal participants in the ongoing conversation about secure software and cryptography. For instance, Jeffrey Goldberg frequently gets involved in discussions of crypto vulnerabilities on Twitter. I don't have a formal recommendation to offer you regarding their team, but I can offer the same "I've talked to these people and feel like they know what they're doing" vibe that Schneier tried to offer for BestCrypt.

Anyways: that's one of the reasons I like 1Password.

Re: KeePass – questionable security

#92

Post by cmdrfred »

sdrapkin wrote: post #86
cmdrfred wrote: post #74

Earlier quoted context omitted.

I have a private server in a datacenter that I put together myself. I use sftp to download/upload my keepass file, I also use a keyfile that stays local and a password for auth. What is the attack vector there?

You store u/p to your Lawyer's website, which has a copy of your Will. You die and the Executor of your Estate tries to access the Lawyer's website, only to be met with "invalid password". It turns out that the kdbx on your private server got silently corrupted (ex. fs corruption) ~5 years prior to your death. However, your Dropbox backups only have 30 days of previous kdbx versions. Can your Executor handle the disa…

How are they cracking the 40+ char random alpha numeric password on my box? With fail2ban in place, and it's on a random port.

Re: KeePass – questionable security

#93

Post by tptacek »

karussell wrote: post #84
tptacek wrote: post #76

Earlier quoted context omitted.

I use and like 1Password.

Is that open source too or how would you know about their security? Cannot find it: https://github.com/AgileBits

When you went looking for it, did you try Googling for [1password file format]?

Re: KeePass – questionable security

#94

Post by sinatra »

tptacek wrote: post #76
mey wrote: post #72

Earlier quoted context omitted.

Considering your background and experience, do you have a recommendation for personal level password management?

I use and like 1Password.

And how do you save and sync the passwords across various machines?

Edit: The reason I asked is because I wanted to see if 1Password can be more secure than LastPass. However, if you're using 1Password with Dropbox, I'd say this combination doesn't feel any more secure than LastPass. Other more secure options like WiFi sync aren't convenient enough. So, it appears there's no strong reason for me to consider switching from LastPass.

Re: KeePass – questionable security

#96

Post by bmj »

salibhai wrote: post #51
xenophonf wrote: post #41

Earlier quoted context omitted.

Password Safe is supposed to be the strongest. I like KeePass 2's user interface a _lot_ better, which is why I'd originally migrated away from Password Safe. However, due to KDBX4's inability to detect data corruption, I plan to migrate back to Password Safe in the very near future.

More about password safe: https://www.schneier.com/passsafe.html

Too bad it is hosted on SourceForge.

Re: KeePass – questionable security

#97

Post by breischl »

littlestitious wrote: post #10

what is the problem with the singleton?

As noted by other commenters, it's not threadsafe in that two different threads might initialize the class at the same time. However, I don't see that anyone bothered to ask "So what?"

If two threads initialize it at once, they'll each create an instance. One will live for the life of the AppDomain. The other will get used briefly, then thrown away. It's a little messy, but will it cause any actual problems?

It's not holding any important state that must not be lost, and it's not holding on to any resources that might be leaked. The worst case is just that you initialize two RNGs instead of one, so you might get slightly different random numbers than you would otherwise get. But they're supposed to be crypto-secure numbers, not "repeatable random" like you might want for a saved game seed, so that seems like it should be acceptable. Unless there's some deep crypto reason that such a thing would be bad?

The two things that might actually matter are that the GeneratedBytesCount might be wrong, and if someone registered an event handler for the GenerateRandom256Pre event it might get lost. Neither of those things are actually used anywhere in the code, but it is possible that client code could use them.

Bottom line I'd say it's not great, but in the code that they actually have it will not cause any problems.

Aside: technically the class is not marked as threadsafe, but since it's a singleton it should probably be threadsafe anyway.

Re: KeePass – questionable security

#98

Post by nycticorax »

freehunter wrote: post #57
rhaps0dy wrote: post #26

And I thought I was safe using Keepass on Dropbox. Any recommendations for password managing?

Well LastPass has had a breach now twice but the integrity of their password database is still holding strong. If you're using Dropbox to share your password database, LastPass having a breach shouldn't be of any concern. I'm fairly certain Dropbox has been broken into more times than LastPass ever will be. As someone who works in the security industry, I use LastPass and recommend it to everyone. It's no less safe t…

"I'm fairly certain Dropbox has been broken into more times than LastPass ever will be."

Really? Why is that?

Post reply on HN