Live data from Hacker News

Non-official site with a tampered version of KeePass

security.infoteam.ch

31–40 of 82 posts

Re: Non-official site with a tampered version of KeePass

#31
post #28

Earlier quoted context omitted.

keepassxc

What if you don't have/want cloud syncing programs installed on your whole system just for the sake of a password manager?

What does this have to do with keepassxc? (the community version of keepassx)

Re: Non-official site with a tampered version of KeePass

#32
post #31

Earlier quoted context omitted.

What if you don't have/want cloud syncing programs installed on your whole system just for the sake of a password manager?

What does this have to do with keepassxc? (the community version of keepassx)

It doesn't have built-in syncing, unlike KeePass. So if you want cloud syncing you have to install an entire syncer on your file system just for the sake of that one program. The assumption that everyone has or wants an automatic behind-the-scenes file syncer installed on every system they use the program on is quite a big and incorrect one.

Re: Non-official site with a tampered version of KeePass

#33

Earlier quoted context omitted.

What if you don't have/want cloud syncing programs installed on your whole system just for the sake of a password manager?

They aren't required. I use KeePassXC and don't use any type of cloud syncing.

No, the question is what if you do want cloud syncing for your passwords (you need to sync with your phone somehow without manually uploading/downloading from a browser every time...), but unable or unwilling to install a background cloud syncer installed on every system you use KeePassXC on. People blindly suggest KeePassXC without realizing not everyone has or wants a cloud syncer installed on their entire system.

Re: Non-official site with a tampered version of KeePass

#34
post #27
post #24

Earlier quoted context omitted.

But there are no guarantees about the source either unless I am willing to audit all of it?

I agree, that's why signed source code releases are the safest thing you can get. Keepass has signed releases (including the source code archive) that can be checked with OpenPGP. https://keepass.info/integrity.html

If you trust the signed source code there's no reason you shouldn't trust the signed binary - unless you have sufficient time and expertise to audit the source.

Re: Non-official site with a tampered version of KeePass

#35

Earlier quoted context omitted.

They aren't required. I use KeePassXC and don't use any type of cloud syncing.

No, the question is what if you do want cloud syncing for your passwords (you need to sync with your phone somehow without manually uploading/downloading from a browser every time...), but unable or unwilling to install a background cloud syncer installed on every system you use KeePassXC on. People blindly suggest KeePassXC without realizing not everyone has or wants a cloud syncer installed on their entire system.

That was worded a bit ambiguously then

You're not really going to get around having to install "something" to sync your passwords if you want to have your passwords synced

You could use something like Syncthing if you just don't want to trust any company with your data

Otherwise, I cant really suggest a solution either

Re: Non-official site with a tampered version of KeePass

#36
post #3

I've reported the website here: https://safebrowsing.google.com/safebrowsing/report_phish/?t... Hopefull it will be blocked by the browsers using the safe browsing list.

Looks like its hosted on wp.com:

https://i0.wp.com/keepass.fr/wp-content/uploads/2018/05/keep...

So maybe we can report it here too:

https://en.wordpress.com/abuse/

Only works if you put this as URL though:

https://wp.com/keepass.fr/

Re: Non-official site with a tampered version of KeePass

#37

Earlier quoted context omitted.

No, the question is what if you do want cloud syncing for your passwords (you need to sync with your phone somehow without manually uploading/downloading from a browser every time...), but unable or unwilling to install a background cloud syncer installed on every system you use KeePassXC on. People blindly suggest KeePassXC without realizing not everyone has or wants a cloud syncer installed on their entire system.

That was worded a bit ambiguously then You're not really going to get around having to install "something" to sync your passwords if you want to have your passwords synced You could use something like Syncthing if you just don't want to trust any company with your data Otherwise, I cant really suggest a solution either

> That was worded a bit ambiguously then

Sorry, I hope it's clear now.

> You're not really going to get around having to install "something" to sync your passwords if you want to have your passwords synced

Huh? This is obviously wrong; I'm doing literally this with KeePass. I haven't installed anything, and it has a plugin to sync directly with Google Drive that doesn't mess with or care about anything in the rest of the system.

Re: Non-official site with a tampered version of KeePass

#38
post #20
post #14

Hah, the Linux version points you to the original website (only the Mac and Windows versions appear to be modified)! The year of the Linux desktop is truly here.

doesnt that just imply that these scammers thought the linux userbase to be too small to be worthwhile? the comparatively small userbase is actually an underappreciated security feature of linux ;)

Or that Linux users would instantly raise a hue and cry on seeing ads?

Re: Non-official site with a tampered version of KeePass

#39

The french is also terrible, google-translated french.

Examples? There's some subject and possession disagreement here and there ("Cette clé, que vous définissez ... accéder à tous ses autres mots de passe"), but otherwise looks pretty good.

There's "crypter" instead of "chiffrer" but I know some people think that "crypter" is acceptable.

Re: Non-official site with a tampered version of KeePass

#40
post #21

Earlier quoted context omitted.

Compile it from source, it's a standard Visual Studio solution that builds without issues.

This. And the benefit is it's easy to add your own fixes to your local version too. Stuff like removing the PerformSelfTest() call, adding items to the ListView in batch, item bounds checking when refreshing the ListView, etc. can quite noticeably speed up the UI, and random window focusing/sizing issues aren't too hard to fix either.

You might also consider submitting such changes as a patch to Dominic, the developer.
Post reply on HN