Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.4.3

keepassxc.org

Post reply on HN
Print view View original

11–20 of 67 posts

Re: KeePassXC 2.4.3

#11

Post by masklinn »

antongribok wrote: post #5
ComodoHacker wrote: post #3

KeePassXC still lacks in-memory protection, so I stay with KeePass, with all its .NET troubles.

I thought that it did now. For example this PR: https://github.com/keepassxreboot/keepassxc/pull/3020 Edit: Also, see this PR: https://github.com/keepassxreboot/keepassxc/pull/371

https://github.com/keepassxreboot/keepassxc/issues/2718#issu...

I'd guess it's this one:

> KeePassXC also cannot prevent data extraction from a hibernation file which stores your computer's memory to disk when going to sleep.

KeePass uses DPAPI so password-storage memory is not written to swap (and I guess hibernatefile) in cleartext. Note that this doesn't protect against reading the memory directly[0].

Though (on unices) it doesn't mention mlock(2) either.

[0] https://www.securityevaluators.com/casestudies/password-mana... subsection "Exposure of Cleartext Entries in Memory" of the Keepass section

Re: KeePassXC 2.4.3

#12

Post by Lendal »

jeltz wrote: post #2

While I love KeePassXC this is just a minor bug fix release.

It is, but the 2.4 release introduced integrated updates. I was still on 2.3 and wasn't aware of this, or that my KeePass was out of date until I saw this this morning. So I am thankful for the heads up. :)

Re: KeePassXC 2.4.3

#13

Post by gruez »

_red wrote: post #4
ComodoHacker wrote: post #3

KeePassXC still lacks in-memory protection, so I stay with KeePass, with all its .NET troubles.

Can elaborate more on the practical benefits of encrypted memory? Presumably this is mainly good for multi-user systems? On the average single-user system it seems that if you can already read memory there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc).

AFAIK the only thing it protects you from is generic malware that scans process memory for passwords. It’s trivial to bypass though: all you need to do is patch the code as it’s running to dump all the plaintext entries for you.

> there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc).

Keepass has mitigations for those as well.

Re: KeePassXC 2.4.3

#14

Post by butteroverflow »

vbezhenar wrote: post #8
ComodoHacker wrote: post #3

KeePassXC still lacks in-memory protection, so I stay with KeePass, with all its .NET troubles.

What troubles? I recently started to use it, and so far I did not encounter any troubles. For me the killer feature of KeePass is that it allows me to safely use it without typing master password using -pw-enc command line argument. I hated to type my password every day over and over again with 1Password. Especially because I understand that it's very weak protection if someone already break in my computer.

I reckon OP dislikes the need to have the whole Mono runtime to run one small-ish application. At least that's the reason I always preferred the native ports.

Re: KeePassXC 2.4.3

#15

Post by mrrsm »

Jonnax wrote: post #7

I was only aware of Keepass itself. What are the differences between KeypassXC, KeepassX and Keepass?

KeePass is the original project. It is an open source dotnet application. The source code, as of the last time I checked, is released as a tar/zip with the binaries only.

KeePassX is an open source c++ application. It was one of the cross platform applications to manage KeePass databases. It has not been under very active development for a while.

KeePassXC is a fork of KeePassX which is under active developement. They have added many features and improvements and has stayed up to date with kdbx updates.

Re: KeePassXC 2.4.3

#16

Post by dexterdog »

giancarlostoro wrote: post #6

Been using BitWarden since I stopped using LastPass (lost my 10 year old vault) anybody know of any good reviews of all the different types of password managers that go into the security flaws / considerations?

I switched from Lastpass to Bitwarden about a year ago as well. I have no complaints except for a few minor UX annoyances in the firefox add-on.

Re: KeePassXC 2.4.3

#18

Post by ComodoHacker »

antongribok wrote: post #5
ComodoHacker wrote: post #3

KeePassXC still lacks in-memory protection, so I stay with KeePass, with all its .NET troubles.

I thought that it did now. For example this PR: https://github.com/keepassxreboot/keepassxc/pull/3020 Edit: Also, see this PR: https://github.com/keepassxreboot/keepassxc/pull/371

Thanks for pointing out. Nice to see progress in this direction.

Re: KeePassXC 2.4.3

#19

Post by vbezhenar »

butteroverflow wrote: post #14
vbezhenar wrote: post #8

Earlier quoted context omitted.

What troubles? I recently started to use it, and so far I did not encounter any troubles. For me the killer feature of KeePass is that it allows me to safely use it without typing master password using -pw-enc command line argument. I hated to type my password every day over and over again with 1Password. Especially because I understand that it's very weak protection if someone already break in my computer.

I reckon OP dislikes the need to have the whole Mono runtime to run one small-ish application. At least that's the reason I always preferred the native ports.

Ah, I'm Windows user, I didn't even know that you could run KeePass on non-Windows systems.

Re: KeePassXC 2.4.3

#20

Post by SamuelAdams »

_red wrote: post #4
ComodoHacker wrote: post #3

KeePassXC still lacks in-memory protection, so I stay with KeePass, with all its .NET troubles.

Can elaborate more on the practical benefits of encrypted memory? Presumably this is mainly good for multi-user systems? On the average single-user system it seems that if you can already read memory there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc).

Crash reports often include memory dumps. Firefox automatically reports these to Mozilla - there's plenty of other software that auto-reports crash data as well. If that crash data includes in-memory credentials, that could lead to your master password being compromised.
Post reply on HN