Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass – questionable security

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 231 posts

Re: KeePass – questionable security

#141

Post by phlo »

tptacek wrote: post #108
sdrapkin wrote: post #102

Earlier quoted context omitted.

Fair enough. I do note that the very blog you linked mentions that there are two 1Password formats: 1. The "Agile Keychain Format" (versions 2 and 3, which lack integrity). 2. The "Cloud Keychain Format" (versions 4+, which have integrity). You didn't specify which version you use & like. I also note that the 1Password team had been selling security software which was not designed well - see (1) above. And it's not l…

If there was a password storage tool designed from the jump by a full-time cryptographic engineer, that'd be the one I'd talk about. Let me know if you find one?

Password Safe [1] was designed by Bruce Schneier, that could fit the bill. It seems to have done quite well in the paper cited by xenophonf in [2], too.

[1] http://passwordsafe.sourceforge.net/

[2] https://news.ycombinator.com/item?id=9727522

Re: KeePass – questionable security

#142

Post by debfx »

sdrapkin wrote: post #78

To those who don't see a problem with leaking timing data: KeePass goes to great lengths to do in-memory encryption of data. I'm not saying these attempts are properly done, but there is certainly no lack of trying. The only reason to even bother is assume that this memory can be accessed by an attacker. So either you subscribe to that attack vector and thus must also accept the necessity of avoiding timing attacks,…

An attacker may be able to read the unencrypted swap space on disk. In this scenario it makes sense to encrypt passwords in memory and store the key in a locked page.

Re: KeePass – questionable security

#143

Post by tetraodonpuffer »

throwaway55512 wrote: post #135
tetraodonpuffer wrote: post #77

Earlier quoted context omitted.

not built in but if you're on linux you can always overlay ecryptfs on your password safe directory, or just have your passwords in a separate vm entirely that is used only for that

ecryptfs doesn't obfuscate filenames (it is a "stacked" filesystem) so that's not going to do any good. You'll need block-level encryption such as LUKS and a loopback mount if you want to keep that hidden, at least when that partition isn't mounted.

are you sure? The manpage discusses ecryptfs_enable_filename_crypto and ecryptfs_fnek_sig

Re: KeePass – questionable security

#144

Post by lewisl9029 »

nivla wrote: post #127
tptacek wrote: post #76

Earlier quoted context omitted.

I use and like 1Password.

Just to be clear this is not directed at you tptacek. However, I am genuinely confused at HN, whenever it comes to security/privacy most yell "Open Source Only" and yet a good chuck of them use 1Password, which I believe is closed source. It really doesn't make any sense. Why trust one over all the others? Obviously given that open source does not equate to security and closed source does not equate to vulnerabilitie…

In the end, choosing software for privacy/security is a matter of trust: How much do you trust a piece of software to protect your privacy/security?

We determine how much we trust a piece of software based on countless different social/technical factors. Being open-source is definitely a positive trust factor, but some people may place more weight on other factors such as pedigree of the developers, availability of corporate backing/funding (guaranteed continued development/support), or maturity/stability of the software itself.

I personally consider being open-source paramount when it comes to security/privacy software (and am one of those people who tend to dismiss anything privacy/security related that's not open-source, although I don't usually feel the urge to broadcast my dismissal to the world), but I respect that other people may not share the same set of priorities.

Re: KeePass – questionable security

#146

Post by ufo »

thomp wrote: post #99

What about pass ( http://www.passwordstore.org/ )? No "funky file formats" -- just GPG and a convenient CLI.

There are two things that bug me about pass:

* Website names are stored in plaintext filenames and directory hierarchies. No confidentiality and no integrity guarantees for those.

* It uses GPG's public-key encryption instead of symmetric-key encription. This integrates well with gpg-agent but it means that you need to carry a gpg private-key file around with you instead of just remembering a passphrase.

Re: KeePass – questionable security

#147

Post by rakoo »

benoliver999 wrote: post #132
ntnn wrote: post #130

Earlier quoted context omitted.

"It's capable of temporarily putting passwords on your clipboard and tracking password changes using git." Holy moly, thats awesome. I think I'm gonna drop keepass for that.

Been using it for a month now, it's fantastic.

Do you use any syncing mechanism, eg syncing to a repo on Github ? The format should lend to using some remote git repo, but I'm still afraid of the implications of having my passwords in the wild, even encrypted with GPG.

Re: KeePass – questionable security

#148

Post by McElroy »

xenophonf wrote: post #12

"On The Security of Password Manager Database Formats" ( https://www.cs.ox.ac.uk/files/6487/pwvault.pdf ) was a good review of KeePass, Password Safe, and others. As I understood it, only Password Safe provided both secrecy and data authenticity.

Password Safe seems interesting. Too bad it's hosted on Source Forge.

Re: KeePass – questionable security

#149

Post by tptacek »

phlo wrote: post #141
tptacek wrote: post #108

Earlier quoted context omitted.

If there was a password storage tool designed from the jump by a full-time cryptographic engineer, that'd be the one I'd talk about. Let me know if you find one?

Password Safe [1] was designed by Bruce Schneier, that could fit the bill. It seems to have done quite well in the paper cited by xenophonf in [2], too. [1] http://passwordsafe.sourceforge.net/ [2] https://news.ycombinator.com/item?id=9727522

Looking the C++ code for this project, this appears to be unauthenticated TwoFish in ECB mode.

(I thought, no, no way is this actually ECB mode, maybe they just did the XOR'ing for CBC mode outside the TwoFish class, but no: they appear to pad blocks explicitly to block boundaries and then ECB them.)

I looked for a total of 4 minutes, so if someone wants to correct me...

Re: KeePass – questionable security

#150

Post by tptacek »

sdrapkin wrote: post #131
eridius wrote: post #123

Earlier quoted context omitted.

Just to note, in the 1Password 4 Cloud Keychain design page[1], he specifically says > When the Agile Keychain format was developed, chosen ciphertext attacks (CCA) were seen as theoretical. Furthermore the primary threat to 1Password users was thought to be from an attacker stealing the data once and pursuing an off-line attack. It did not anticipate an attacker who could tamper with user data that would be subseque…

I don't buy this "explanation" for the following reason: Even if they could not anticipate an attacker tampering with user data, surely they should've been able to anticipate filesystem corruption? Let's not pretend that MACs and secure integrity checks were a modern marvel just because CCA attacks were seen as theoretical back then.

Can you help me understand what your fundamental argument is here? It seems pretty straightforward that the old, unauthenticated format is bad. Clearly, they didn't take crypto design very seriously when they shipped a product based on it. Is there some deeper subtext here?

Whatever that subtext might be: it's especially weird coming from you, since you're the author of the story at the top of this thread, about a current version of KeePass that uses unauthenticated encryption. The EtM CBC+HMAC crypto design we're talking about for 1Password is years old.

Post reply on HN