Is it possible to sync your passwords with other devices?
KeePassXC 2.4.3
21–30 of 67 posts
Re: KeePassXC 2.4.3
#22Earlier quoted context omitted.
Can elaborate more on the practical benefits of encrypted memory? Presumably this is mainly good for multi-user systems? On the average single-user system it seems that if you can already read memory there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc).
AFAIK the only thing it protects you from is generic malware that scans process memory for passwords. It’s trivial to bypass though: all you need to do is patch the code as it’s running to dump all the plaintext entries for you. > there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc). Keepass has mitigations for those as well.
> AFAIK the only thing it protects you from is generic malware that scans process memory for passwords.
Apparently it doesn't even do that: https://www.securityevaluators.com/casestudies/password-mana... (section Keepass)
Possibly because keepass uses the wrong flag? https://docs.microsoft.com/en-us/dotnet/api/system.security.... seems to say that the memory segment can be decrypted by either:
* all processes running on the box
* all processes owned by the same user
* only this process
Alternatively, might be because C# and the memory protection primitives don't prevent the GC from copying its data out of the protected area? IDK
edit: ah, or they might be using ProtectedData rather than ProtectedMemory, that only has the "same machine" and "same user" levels of protection: https://docs.microsoft.com/en-us/dotnet/api/system.security....
Re: KeePassXC 2.4.3
#23Anybody know if they've fixed (or plan to fix) the sort by latest modification date of all records? That was the one missing feature from going from KeePassX to KeePassXC.
Re: KeePassXC 2.4.3
#24I was only aware of Keepass itself. What are the differences between KeypassXC, KeepassX and Keepass?
The difference is the UI. They all use the same* database format underneath.
Thr original Keepass was at first a Windows only app, so KeepassX was created as a cross platform reimplementation using Qt. Nowadays Keepass uses .Net and also is cross platform but Linux users prefer Qt because it feels more "native" than .Net.
KeepassXC is a more recent fork of KeepassX, which added a bunch of extra features. Notably, it added support for version 4 of the keepass database format, and it also allows you to use a browser extension to enter passwords inside web browser forms without needing to cut and paste.
Re: KeePassXC 2.4.3
#25Why should I switch from pass (git+pgp) to keepassx ?What's one feature in keepassx nto in pass/passx
Re: KeePassXC 2.4.3
#26Earlier quoted context omitted.
Can elaborate more on the practical benefits of encrypted memory? Presumably this is mainly good for multi-user systems? On the average single-user system it seems that if you can already read memory there are 1000 other possible exploits that are cheaper / easier to perform (ie. keylog, screen capture, etc).
Crash reports often include memory dumps. Firefox automatically reports these to Mozilla - there's plenty of other software that auto-reports crash data as well. If that crash data includes in-memory credentials, that could lead to your master password being compromised.
KeepassXC disables core dumps[0].
[0] https://github.com/keepassxreboot/keepassxc/issues/2718#issu...
Re: KeePassXC 2.4.3
#27Is it possible to sync your passwords with other devices?
Yes, you can store the database file in a shared drive (not sure that's proper security though)
Re: KeePassXC 2.4.3
#28Why should I switch from pass (git+pgp) to keepassx ?What's one feature in keepassx nto in pass/passx
For me the biggest difference is that you have a single encrypted database file, and that no metadata is stored unencrypted. By default, pass uses file names as keys, so website names are stored in the clear. (To fix this on pass.you need to use pass-tomb, which I found very clunky, and could never get working quite right)
Another thing I like about keepassxc is that it has lots of features. It comes with a flexible passwird generator, has a friendly GUI UI, can be integrated to the web browser using an extension, and there are compatible android apps you can use on your phone.
Re: KeePassXC 2.4.3
#29Why should I switch from pass (git+pgp) to keepassx ?What's one feature in keepassx nto in pass/passx
I am a pass user and for me the big drawback is that is exposes the website names by design.