0

I'm afraid this could be a very stupid question, yet I cannot think of an explanation. Password managers (keepass, etc.) often have a button that lets you "lock" the database, so if you need a password you will have to unlock it again by entering the master password. The database could also be locked automatically after some time, or when the screen saver starts, etc.

It's clear why you should unlock the database the first time you use it after you turn on your computer, because it's encrypted. But why should you ever need to lock / unlock it again afterwards? The first thing that comes to mind is "what if an attacker accesses you computer while it's turned on and you are away", but for that matter there should be a screen locker, otherwise you are screwed anyway. It doesn't seem to prevent problems with malware or cold boot attacks either.

What threat is this trying to mitigate then? I can only think it can be useful to protect against a very low-level attacker with no skills at all, in case you leave your computer and forget to lock the screen. This kind of attacker would be able to take a look around (and read info from your unlocked password manager) but they wouldn't be able to install malware or compromise the machine in any other way. Or maybe I'm missing something.

Improve this question

1 Answer 1

Reset to default
2

"Locking" the database (in KeePass, "Lock" just plain closes the database) means that the decryption key for the database and any decrypted passwords from the database are no longer accessible in memory. Without that protection, something like KeeFarce can be used to extract that information:

KeeFarce allows for the extraction of KeePass 2.x password database information from memory. The cleartext information, including usernames, passwords, notes and url's are dumped into a CSV file in %AppData%

Something like that could be run by someone who got malicious code running on your machine. One of the first things an attacker will do, once they get code running on your machine, is to look for credentials that it can use to extend their access to other systems. This fits that bill.

Improve this answer
4
  • I don't agree. Keefarce is a "farce", that is, it's not needed. Once you have malicious code running on your computer, everything can be a "farce". Just think of a keylogger, it's going to get your master password anyway, whether you lock / unlock / wipe the memory or not. So this doesn't answer my question, because it doesn't justify the locking feature.
    – reed
    Nov 25, 2018 at 15:52
  • 1
    @reed speaking as a Red Teamer, the difference between being able to capture credentials en masse out of memory immediately, as opposed to waiting and hoping your keylogger will catch the database password, is massive. Attackers are opportunistic and want to pivot immediately, not wait for a theoretical payoff.
    – gowenfawr
    Nov 25, 2018 at 16:23
  • @reed, you also mentioned cold boot attacks. Locking the DB does protect the DB contents from cold boot attacks, since the decryption key and decrypted database are removed from memory when you fully lock (but not necessessarily for "quick unlock" features which don't require the full password and presumably keep the key in memory lightly encrypted or something).
    – Ben
    Nov 25, 2018 at 17:18
  • @gowenfawr, waiting for the next unlock or at most the next reboot is not just a "theoretical" payoff, IMO. The KeePass website itself says that KeeFarce is not at attack or a threat, because it's possible to achieve the same result more easily in several other ways (like with keyloggers). You are making it sound like an attacker usually won't be willing to use other methods to get the passwords, other than trying to "easily" get them out of memory. I just don't think that's true.
    – reed
    Nov 25, 2018 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .