2

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user wants it to be. This brings the ability to keep the database offline and secret instead of storing it on a companys servers, like it's the case when you use password managers like LastPass, Dashlane, Keeper etc. For me these are the main advantages of Keepass over commercial password managers.

Because I want to have my passwords with me wherever I go, I feel the need of using a mobile App (iOS) which is capable of handling Keepass databases. Unfortunately these apps aren't official, but unofficial ports by other people. Some of them are even closed source.

What happens if these apps are bad implemented or not maintained continously? Is Keepass still secure when using such third party apps and is there any advantage of open-source if the app is closed source? Is there still a security advantage over a closed source commercial password manager?

  • 1
    There's very high risk that 3rd party app which handles your database will send your all passwords somewhere. Even if it's posing to be open source. – Aria Feb 14 '18 at 12:37
3

The problem with any application that can access your password safe contents is that it could potentially do anything with the passwords: send them to a server, save them on your hard drive in plain text format, delete them, change one character in every entry, etc.

This applies to both open source and closed source software, unless you are examining the specific actions which are taken by the executing program. Can you be sure that the copy of KeePass you have was built from the same code as you can download?

You have made the decision that the official version of KeePass is trustworthy, and won't steal your passwords. You now have to decide whether you trust the unofficial mobile ports to the same degree, which depends on your appetite for risk.

Things to consider:

  • Potentially fewer users than the main Windows version, so reduced chance of issues being picked up
  • Difficulty of checking exactly what code is running on a mobile device (even if the code is available)
  • Potentially increased risk of unnoticed outbound connections

However, even given this, assuming that whatever mobile application you pick is not malicious, you keep a greater degree of control over where the main password safe file is kept than with a cloud password manager. You can always keep a full safe on your computer, and a secondary one on your mobile device, containing a subset of passwords. In that case, even if the app turns out to be malicious, you would have a core of unaffected high risk passwords, although it loses some of the convenience of a password manager.

  • Thank you for valuation. These are some very good points, that help me with finding a proper solution. You sound like you are very familiar with the topic. May I ask you what password manager do you trust? – David Feb 16 '18 at 9:09
  • I use a mix of different ones, for different categories of passwords: I've got actively used Password Safe, KeePass, LastPass and Dashlane safes - the local ones for more sensitive passwords, and the cloud ones for day-to-day use. – Matthew Feb 16 '18 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.