Live data from Hacker News

KeePass – questionable security

news.ycombinator.com

121–130 of 231 posts

Re: KeePass – questionable security

#121
Hello!

Nothing about KeePass, but recently I was wondering if I could write a software for deriving the keys from the master secret and seed (i.e. domain name or whatever).

Here is what I have came with:

* https://github.com/indutny/derivepass * https://github.com/indutny/scrypt

It is using dump scrypt implementation (see the second link), and should be pretty easy to verify by cross-reading the source and the spec. Also, there is a boilerplate iOS application which is using `derivepass`'s derivation function and `scrypt` too.

Please let me know if you have any questions!

Re: KeePass – questionable security

#122
For anyone who has wanted to switch to KeePassX (to avoid mono dependencies, for instance), but needed the integration with keepasshttp, this project is active: https://github.com/Ivan0xFF/keepassx

I haven't switched yet to Ivan0xFF's port yet (I've been using the auto-type based on window title). I may not actually switch, as the Pass project some others have posted here looks very good as a cross-platform solution (e.g., there is an android app and Firefox plugin) and there are scripts for converting existing databases to the new keystore.

Re: KeePass – questionable security

#123
post #91

Earlier quoted context omitted.

I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/yo…

Fair enough. I do note that the very blog you linked mentions that there are two 1Password formats: 1. The "Agile Keychain Format" (versions 2 and 3, which lack integrity). 2. The "Cloud Keychain Format" (versions 4+, which have integrity). You didn't specify which version you use & like. I also note that the 1Password team had been selling security software which was not designed well - see (1) above. And it's not l…

Just to note, in the 1Password 4 Cloud Keychain design page[1], he specifically says

> When the Agile Keychain format was developed, chosen ciphertext attacks (CCA) were seen as theoretical. Furthermore the primary threat to 1Password users was thought to be from an attacker stealing the data once and pursuing an off-line attack. It did not anticipate an attacker who could tamper with user data that would be subsequently processed by the legitimate owner.

> CCAs are no longer just theoretical, and we also see (and encourage) widespread storage of 1Password data in “the cloud” for syncing. Thus data integrity needs to be addressed in our new design.

It would have been great if the Agile keychain format included integrity, but hindsight is 20/20.

[1]: https://learn2.agilebits.com/1Password4/Security/keychain-de...

Re: KeePass – questionable security

#124

It's better than nothing and likely better than something without source. Using the CLR which has no guaranteed memory zeroing and has immutable strings and GC and an exposed profiler and debugging APi is a larger concern IMHO.

> the CLR which has no guaranteed memory zeroing That's interesting. Can you elaborate? > and has immutable strings and GC Immutable strings is a pretty standard feature for a language, right?

Basically, when an object goes out of scope, it isn't de-allocated instantly.

Immutable strings aren't standard; they're an implementation choice.

Re: KeePass – questionable security

#125

It's better than nothing and likely better than something without source. Using the CLR which has no guaranteed memory zeroing and has immutable strings and GC and an exposed profiler and debugging APi is a larger concern IMHO.

I didn't check but I assume they use SecureString.

I'd be surprised if they did and don't forget that it's serialized/deserialized from something which will be hanging around in the GC in the form of a memory backed stream or something too.

Re: KeePass – questionable security

#126
From my point of view, an authenticator (e.g. HMAC) is only necessary in case of a protocol-based transmission. -> And no, I don't mean to put the file (that is completly read first) on the dropbox. An authentication between the main memory and the CPU is obviously not required.

Re: KeePass – questionable security

#127
post #76
post #72

Earlier quoted context omitted.

Considering your background and experience, do you have a recommendation for personal level password management?

I use and like 1Password.

Just to be clear this is not directed at you tptacek. However, I am genuinely confused at HN, whenever it comes to security/privacy most yell "Open Source Only" and yet a good chuck of them use 1Password, which I believe is closed source. It really doesn't make any sense. Why trust one over all the others? Obviously given that open source does not equate to security and closed source does not equate to vulnerabilities. It make it even more disconcerting when you see a security or privacy related "Show HN:" being immediately dismissed for choosing closed source.

Re: KeePass – questionable security

#128
post #127
post #76

Earlier quoted context omitted.

I use and like 1Password.

Just to be clear this is not directed at you tptacek. However, I am genuinely confused at HN, whenever it comes to security/privacy most yell "Open Source Only" and yet a good chuck of them use 1Password, which I believe is closed source. It really doesn't make any sense. Why trust one over all the others? Obviously given that open source does not equate to security and closed source does not equate to vulnerabilitie…

I like open source but certainly do not believe that it is always the best choice when it comes to security.

Re: KeePass – questionable security

#129

Earlier quoted context omitted.

Well LastPass has had a breach now twice but the integrity of their password database is still holding strong. If you're using Dropbox to share your password database, LastPass having a breach shouldn't be of any concern. I'm fairly certain Dropbox has been broken into more times than LastPass ever will be. As someone who works in the security industry, I use LastPass and recommend it to everyone. It's no less safe t…

They way I see it, the downside of LastPass is that it's online, so they could at request of some government or in case of a hack change the code that you execute to capture your master password or do whatever. This obviously can be done with offline software too, but it's much harder/slower process. Also I don't quite understand the point of encrypting your database in Dropbox. It's already encrypted. The problem is…

How would that happen with 2FA set up? Even if they have your master password, how do they copy your Authenticator code or YubiKey or whatever else you might use?

I see people struggle with offline password managers to the point where they never use them or they get burned once because they're somewhere without access to their database and they stop using them. LastPass alleviates all of that. People make the same claims about TouchID (it's not secure, look at these theoretical bypasses, etc) but the fact is (which I thought I pointed out earlier) that convenient security is better than no security and no security is what you're going to get.

You think the government can't download things from your Dropbox and you think they can't decrypt your database? We know better now. The fear of "what if the government does" is completely gone. Even if they can't get to your password, they'll just go straight to Google or worst case scenario, straight to AT&T. The difference between encrypting like SpiderOak vs uploading an encrypted file like DropBox is that DropBox can hand over your password database to anyone they want to give it to. SpiderOak can't. You don't need to try to hide the fact that you have a password database, no one can tell in the first place. Security through obscurity isn't no security, it's just poor security and poor security is better than nothing (and far better when combined with good security).

You're using a password manager to keep your accounts safe from petty criminals and identity thieves, not from APTs or shady governments. And if you're using DropBox, the government probably already has it. I guess you'd have to ask Condoleezza Rice about that.

Use whatever you want, everyone has different needs and opinions. But I will continue recommending LastPass (and at the very least, strongly recommending against whatever + DropBox). Like I said, it's no less secure than whatever + DropBox. But it's a heck of a lot more convenient.

Re: KeePass – questionable security

#130
post #99

What about pass ( http://www.passwordstore.org/ )? No "funky file formats" -- just GPG and a convenient CLI.

"It's capable of temporarily putting passwords on your clipboard and tracking password changes using git."

Holy moly, thats awesome. I think I'm gonna drop keepass for that.

Post reply on HN