Live data from Hacker News

Non-official site with a tampered version of KeePass

security.infoteam.ch

21–30 of 82 posts

Re: Non-official site with a tampered version of KeePass

#21
post #15

What are some safety measures you take when downloading a new version of keepass? Checking the digital signature of the binary? Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.

Compile it from source, it's a standard Visual Studio solution that builds without issues.

Re: Non-official site with a tampered version of KeePass

#22
post #20
post #14

Hah, the Linux version points you to the original website (only the Mac and Windows versions appear to be modified)! The year of the Linux desktop is truly here.

doesnt that just imply that these scammers thought the linux userbase to be too small to be worthwhile? the comparatively small userbase is actually an underappreciated security feature of linux ;)

not the website owner but people involved in the PUP ecosystem.

i'm sure that if installcore supported linux, then the linux binaries would also be bundlers.

Re: Non-official site with a tampered version of KeePass

#23

Pretty ironicly, Terms of use warn to be very careful when downloading files with an exe.,. Vbs,. Lnk,. Bat,. Sys, or a suffix com., Because these files may contain a virus or spyware !

It's a common technique used by hucksters, "here's some friendly advice ...", it's both an attempt to signal good intent and to load the mark with a subconscious sense of having been done a favour (and so needing to do a favour back to the huckster/salesman.

Re: Non-official site with a tampered version of KeePass

#24
post #21
post #15

What are some safety measures you take when downloading a new version of keepass? Checking the digital signature of the binary? Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.

Compile it from source, it's a standard Visual Studio solution that builds without issues.

But there are no guarantees about the source either unless I am willing to audit all of it?

Re: Non-official site with a tampered version of KeePass

#25
post #21
post #15

What are some safety measures you take when downloading a new version of keepass? Checking the digital signature of the binary? Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.

Compile it from source, it's a standard Visual Studio solution that builds without issues.

This. And the benefit is it's easy to add your own fixes to your local version too. Stuff like removing the PerformSelfTest() call, adding items to the ListView in batch, item bounds checking when refreshing the ListView, etc. can quite noticeably speed up the UI, and random window focusing/sizing issues aren't too hard to fix either.

Re: Non-official site with a tampered version of KeePass

#27
post #24
post #21

Earlier quoted context omitted.

Compile it from source, it's a standard Visual Studio solution that builds without issues.

But there are no guarantees about the source either unless I am willing to audit all of it?

I agree, that's why signed source code releases are the safest thing you can get. Keepass has signed releases (including the source code archive) that can be checked with OpenPGP.

https://keepass.info/integrity.html

Re: Non-official site with a tampered version of KeePass

#28
post #15

What are some safety measures you take when downloading a new version of keepass? Checking the digital signature of the binary? Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.

keepassxc

Re: Non-official site with a tampered version of KeePass

#29
post #28
post #15

What are some safety measures you take when downloading a new version of keepass? Checking the digital signature of the binary? Original keepass downloads are hosted on sourceforge which has not had the best history of integrity the way I see it.

keepassxc

What if you don't have/want cloud syncing programs installed on your whole system just for the sake of a password manager?

Re: Non-official site with a tampered version of KeePass

#30
post #28

Earlier quoted context omitted.

keepassxc

What if you don't have/want cloud syncing programs installed on your whole system just for the sake of a password manager?

They aren't required. I use KeePassXC and don't use any type of cloud syncing.
Post reply on HN