Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass – questionable security

news.ycombinator.com

Post reply on HN
Print view View original

111–120 of 231 posts

Re: KeePass – questionable security

#111

Post by [deleted] »

sdrapkin wrote: post #55
ifdefdebug wrote: post #43

Earlier quoted context omitted.

That's quite harsh. I guess you verified that there are actually different threads able to access this code before making such a statement? For instance, if I make a single-threaded application in the first place then I don't care about thread-safety at all. Because I am not going to need it.

I have verified that the CryptoRandom class is part of a standalone library with (1) should be thread-safe since it cannot dictate how it will be used by callers; (2) the authors clearly intended this library to be thread-safe (based on "thread-safe" comments in its source code). And in all likelihood it is thread-safe - but that's due to being lucky - not competent. The larger issue is that we have a widely-used cry…

[deleted]

Re: KeePass – questionable security

#112

Post by MaikuMori »

freehunter wrote: post #57
rhaps0dy wrote: post #26

And I thought I was safe using Keepass on Dropbox. Any recommendations for password managing?

Well LastPass has had a breach now twice but the integrity of their password database is still holding strong. If you're using Dropbox to share your password database, LastPass having a breach shouldn't be of any concern. I'm fairly certain Dropbox has been broken into more times than LastPass ever will be. As someone who works in the security industry, I use LastPass and recommend it to everyone. It's no less safe t…

They way I see it, the downside of LastPass is that it's online, so they could at request of some government or in case of a hack change the code that you execute to capture your master password or do whatever.

This obviously can be done with offline software too, but it's much harder/slower process.

Also I don't quite understand the point of encrypting your database in Dropbox. It's already encrypted. The problem is that someone could monitor how your encrypted file is changing and that way simplify decryption. And that doesn't change even if you encfs. Unless the point of it is to hide that you have password db in Dropbox.

Re: KeePass – questionable security

#114

Post by tptacek »

sinatra wrote: post #94
tptacek wrote: post #76

Earlier quoted context omitted.

I use and like 1Password.

And how do you save and sync the passwords across various machines? Edit: The reason I asked is because I wanted to see if 1Password can be more secure than LastPass. However, if you're using 1Password with Dropbox, I'd say this combination doesn't feel any more secure than LastPass. Other more secure options like WiFi sync aren't convenient enough. So, it appears there's no strong reason for me to consider switching…

With the 1Password syncing feature.

Re: KeePass – questionable security

#115

Post by linuskendall »

secstate wrote: post #90
tptacek wrote: post #76

Earlier quoted context omitted.

I use and like 1Password.

Too bad the only way to use 1Password with linux or a BSD is some jaxy browser extension.

Windows version works perfectly well under Wine, though you won't get official browser extension to work for autofill.

Re: KeePass – questionable security

#116

Post by alelefant »

sdrapkin wrote: post #13
negus wrote: post #4

Ok, your password database was affected by malicious modification. So what? How it can break the confidentiality of your data? Update: By the way, what's wrong with the bytearray compare code snippet?

I notice that the "change-password" function of yourbank.com is accidentally being served over HTTP instead of HTTPS. I just need to trick you into changing your password. I have access to your kdbx db (ex. you sync to Dropbox and I'm Dropbox employee). I can alter the kdbx file to change your password so that it is no longer valid. KeePass doesn't complain at all. You have a WTF moment and try to change your passwor…

If you're able to inspect the network packets and the page is over HTTP, then KeePass doesn't even matter at that point. It's game over right there.

Re: KeePass – questionable security

#117

Post by diddeb »

sinatra wrote: post #94
tptacek wrote: post #76

Earlier quoted context omitted.

I use and like 1Password.

And how do you save and sync the passwords across various machines? Edit: The reason I asked is because I wanted to see if 1Password can be more secure than LastPass. However, if you're using 1Password with Dropbox, I'd say this combination doesn't feel any more secure than LastPass. Other more secure options like WiFi sync aren't convenient enough. So, it appears there's no strong reason for me to consider switching…

I tend to use Dropbox. But there are a multitude of options available to users.

Re: KeePass – questionable security

#118

Post by alkonaut »

wumbernang wrote: post #5

It's better than nothing and likely better than something without source. Using the CLR which has no guaranteed memory zeroing and has immutable strings and GC and an exposed profiler and debugging APi is a larger concern IMHO.

> the CLR which has no guaranteed memory zeroing

That's interesting. Can you elaborate?

> and has immutable strings and GC

Immutable strings is a pretty standard feature for a language, right?

Re: KeePass – questionable security

#119

Post by xenophonf »

salibhai wrote: post #65
xenophonf wrote: post #36

Earlier quoted context omitted.

Confidentiality isn't your only concern. You should also be worried about integrity and availability. From "On The Security of Password Manager Database Formats": Unfortunately, [KDBX4] introduces new vulnerabilities. Similarly to KDB, the main problem of this format is the lack of authentication of *hdr*. As such, is it susceptible to modifications... This modification is not detectable by the password manager... if…

How will you do that? It looks tricky to say the least: http://sourceforge.net/p/passwordsafe/discussion/134801/thre... EDIT: It looks like you can clear out all the comments and other stuff in the db and export to Keepass v1 CSV and you should be able to import from that.

Hey, thanks a ton for the clue!
Post reply on HN