If you look at the KeePass security information, it says:

However in all the questions above we're assuming that there's a spyware program running on the system that's specialized on attacking KeePass.

In this situation, the best security features will fail. This is law #1 of the 10 Immutable Laws of Security [4] [5]: "If a bad guy can persuade you to run his program on your computer, it's not your computer anymore".

Given the wide use of KeePass, let's assume that there are specialized KeePass attacks available. Also, the number of zero day exploits etc. makes me feel that I can't really guarantee that me PC has not been hacked.

In such a situation, is there a way to still use KeePass, but protect against specialized attacks?

  • 2
    Looking at the recent password breaches and the stupid passwords that are in there I'm not sure I agree that Keepass has a "wide use". Jun 9 '16 at 22:01
  • 2
    @AndréBorie: maybe not among average PC users, but I think it's used by staff in critical positions like IT admins etc. That makes a specialized attack even worse. Jun 9 '16 at 22:03

In such a situation, is there a way to still use KeePass, but protect against specialized attacks?

Absolutely; the simplest and most basic is called "air gap" protection.

  • Take a computer with no network connection, no speaker, and no microphone, such as a Raspberry Pi 2.
  • Use wired keyboards, mice, monitors, etc. No wireless anything!
  • Set it up with the minimum required software - if you insist or for a basic proof of concept, you can start with NOOBS Raspbian.
    • Patch it, ideally offline (see below for one-way transfers), but you could do it online before you actually start using KeePass at all
  • Fill the ethernet jack with epoxy; it is NEVER to be used.
  • Install KeepassX
  • NEVER AGAIN move any data off this machine in any electronic way. Updates can go in, but nothing comes out electronically. Read the screen and hand-type.
    • burn CD-ROMs with whatever updates you need to move to the KeePass only machine and then use a USB CD-ROM to read them, then shred the CD (just in case something got written to it).
    • or use something like an Apricorn flash drive; wipe it, set a password, put the data on it, enter the password and use it on the KeePass machine, then immediately wipe it again BEFORE it goes in any other machine.
  • For the truly paranoid, use a dedicated monitor, mouse, and keyboard that never get used for anything else; the older and less advanced the better.
  • Don't use it where any electronic cameras - like your laptop/webcam/fancy video conferencing monitor - can see screen emissions.

This way, even assuming that some specialized software gets onto the machine, someone has to be in reasonable physical proximity to be able to extract data; hear the sounds the chips and/or power supply make, watch thermal patterns, see the emissions from the machine, monitor, keyboard, etc., but the machine itself has no networking or radios at all - no bluetooth, no wifi, no cell modem, no ethernet cable, etc.

CRITICAL - back up that KeePass file regularly to something like an Apricorn mentioned earlier, or paper (dedicated printer, no networking, no wireless capability), etc.

CRITICAL if using a Pi - run that Raspberry Pi on a UPS of some sort - Raspbian reacts very badly to sudden power loss while turned on some of the time.

  • A raspberry pi is a great cheap way of doing it, you could also say if you have a spare computer with full disk encryption to harden against physical theft.
    – 99Con
    Jan 18 '18 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.