Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux

Question

please forgive beginner question. I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu.

I have been using Keepass2 which is just such an amazing password manager; HOWEVER I have the following 2 questions re this:

1. I am using KeePass-Http connector (just such a useful and quick extension to enter logins/passwords!) and there are some security concerns re this:

from the website of KeepassXC: https://keepassxc.org/project/

A note about KeePassHTTP KeePassHTTP is not a highly secure protocol and has certain flaws which allow an attacker to decrypt your passwords if they manage to intercept communication between a KeePassHTTP server and KeePassHTTP-Connector over a network connection (see https://github.com/pfn/keepasshttp/issues/258 and https://github.com/keepassxreboot/keepassxc/issues/147. )KeePassXC therefore strictly limits communication between itself and the browser plugin to your local computer. As long as your computer is not compromised, your passwords are fairly safe that way, but use it at your own risk! As of KeePassXC 2.3, we deprecated KeePassHTTP in favor of KeePassXC-Browser.

However, I have now tried using KeepassXC which has changed beyond recognition in the past few months. Superb! It doesn’t need Mono (if I understand correctly) and it uses KeePassXC-Browser (rather than KeepassHTTP)

Would anyone have any comments re the security of KeePassXC-Browser extension?

Also 2. in order to run Keepass2 (esp if also using the Keepass-Http connector) one needs Mono. Some would say Mono is a security risk. See https://sites.google.com/site/easylinuxtipsproject/security

Is this correct? – I would have thought that I would be unlikely to ‘accidentally’ execute malware as root under Linux?

Sorry for mix of questions… basically I am asking if, under Linux, KeepassXC would probably be safer to use compared to Keepass2?

Answer 1

The mix of questions makes harder to reply, it would be preferable to ask different things as separate questions.

I will try to provide a general answer to the things you mentioned:

Some would say Mono is a security risk. See https://sites.google.com/site/easylinuxtipsproject/security Is this correct? –

This page makes the point that by installing wine or mono, as that allows you to run more programs (like windows ones), they make easier to run malware, too. (As you could be infected by eg. a ransomware that was developed for a windows target).

YMMV, as you may find that the benefit of running program X outweights the added risk of higher exposure.

I would have thought that I would be unlikely to ‘accidentally’ execute malware as root under Linux?

How unlikely you are to accidentally a malware of coke depends a lot on the person. Some people are very conscious and won't run as root anything not completely innocuous (or even they restrict themselves to their package manager), while others will do all kinds of stupid-to-harmful actions… as root (and should have no root privileges at all).

However, running malware != running malware as root. Even if it isn't able to run as root, a malware can do a lot of harm, for example a ransomware. Your system files (which could be recovered by reinstalling) will be safe, but your photos and personal data won't. This was expressed by Randall Munroe on his xkcd 1200: Authorization:

(image under a CC-BY-NC-2.5 license)

Is KeePassXC-Browser better than KeePassHTTP ?

I haven't studied the extensions themselves, but from a brief look at the linked bugs, I think it is. If any, because KeePassHTTP has some shortcomings that KeePassXC-Browser was designed to fix.

Note however that you could be using either of them without any browser plugin, in which case this piece may not be important.

I personally prefer KeepassXC to Keepass2 under Linux as I find it to integrate better with the system overall. But in a security aspect, I would say that you can use both of them in a safe way. KeepassXC would probably be safer? Maybe. Although the difference may be marginal.