Non-official site with a tampered version of KeePass

Post by lakechfoma » Fri, Jul 27, 2018, 7:42 PM UTC

slededit wrote: post #64

lakechfoma wrote: post #55

Earlier quoted context omitted.

Rather unfortunate that "putty.org" is the first result in searches and looks a lot more legit than "chiark.greenend.org.uk" even if it (currently) links there. I've had discussions with coworkers on why they shouldn't look up "free online json beautifier" and dump thousands of lines of crown jewels into them (http too). Meanwhile we're doing web dev and JSON responses are autoformatted in Firefox dev tools so there'…

It's putty's own fault. They used to (and perhaps still do) have a section on how they don't want your donated domain - they like their current one. From their FAQ: > No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find…

Post by pandasun » Fri, Jul 27, 2018, 8:24 PM UTC

campuscodi wrote: post #61

redsec wrote: post #57

Earlier quoted context omitted.

Thanks for the update, they all look to come from the same guys.

They do. They're all registered via one email: https://domainbigdata.com/gmail.com/mj/0DnwUjDWo0L7ysS4kB00p...

Post by teget » Fri, Jul 27, 2018, 9:09 PM UTC

mar77i wrote: post #74

Unrelated to the topic, the article points out a lot of things about certificates in the URL bar. That got me to think about the URLs themselves, can I set my browser up so it displays the punycode representation of my url?

Post by amaccuish » Fri, Jul 27, 2018, 10:04 PM UTC

simias wrote: post #39

dddddaviddddd wrote: post #10

Earlier quoted context omitted.

Examples? There's some subject and possession disagreement here and there ("Cette clé, que vous définissez ... accéder à tous ses autres mots de passe"), but otherwise looks pretty good.

There's "crypter" instead of "chiffrer" but I know some people think that "crypter" is acceptable.

Post by perl4ever » Sat, Jul 28, 2018, 5:31 AM UTC

mihaifm wrote: post #42

svenfaw wrote: post #34

Earlier quoted context omitted.

If you trust the signed source code there's no reason you shouldn't trust the signed binary - unless you have sufficient time and expertise to audit the source.

This is how I view it: * Being open source protects against a malicious developer. Otherwise there is nothing preventing him to build the binary with a different source, and send the passwords to his own server. * Signed code archive prevents against a compromised hosting site.