How secure is Keepass when using mobile apps

Question

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user wants it to be. This brings the ability to keep the database offline and secret instead of storing it on a companys servers, like it's the case when you use password managers like LastPass, Dashlane, Keeper etc. For me these are the main advantages of Keepass over commercial password managers.

Because I want to have my passwords with me wherever I go, I feel the need of using a mobile App (iOS) which is capable of handling Keepass databases. Unfortunately these apps aren't official, but unofficial ports by other people. Some of them are even closed source.

What happens if these apps are bad implemented or not maintained continously? Is Keepass still secure when using such third party apps and is there any advantage of open-source if the app is closed source? Is there still a security advantage over a closed source commercial password manager?

Answer 1

The problem with any application that can access your password safe contents is that it could potentially do anything with the passwords: send them to a server, save them on your hard drive in plain text format, delete them, change one character in every entry, etc.

This applies to both open source and closed source software, unless you are examining the specific actions which are taken by the executing program. Can you be sure that the copy of KeePass you have was built from the same code as you can download?

You have made the decision that the official version of KeePass is trustworthy, and won't steal your passwords. You now have to decide whether you trust the unofficial mobile ports to the same degree, which depends on your appetite for risk.

Things to consider:

• Potentially fewer users than the main Windows version, so reduced chance of issues being picked up
• Difficulty of checking exactly what code is running on a mobile device (even if the code is available)
• Potentially increased risk of unnoticed outbound connections

However, even given this, assuming that whatever mobile application you pick is not malicious, you keep a greater degree of control over where the main password safe file is kept than with a cloud password manager. You can always keep a full safe on your computer, and a secondary one on your mobile device, containing a subset of passwords. In that case, even if the app turns out to be malicious, you would have a core of unaffected high risk passwords, although it loses some of the convenience of a password manager.