Questions tagged [keepass]
KeePass is a free, open source password manager for Windows. It has unofficial ports for Linux, Mac OS X, Android, and iPhone. Passwords are protected with strong encryption keyed with a master password.
101
questions
0
votes
2
answers
102
views
Extract Keepass password generator dictionary [closed]
Can I extract a dictionary list from the keepass password generator as my senior forgot his master password?
1
vote
0
answers
135
views
How to crack KeePass database when knowing the first part of the master password [duplicate]
I have a KeePass 2.47 database which is protected with a master password and a key file.
I managed to lose the 2nd part of my master password. So, I have access to the database, the key file and the ...
- 111
1
vote
2
answers
133
views
Why do entropies of passwords significantly differ from site to site?
I read the infamous xkcd cartoon comparing two passwords and their strength. Curious whether their calculation was accurate, I searched many entropy calculators and plugged in the two examples from ...
- 11
2
votes
1
answer
265
views
Is CVE-2023-24055 applicable to other password managers using the same format as the original KeePass?
CVE-2023-24055 is a known vulnerability that enables an attacker to recover plaintext user credentials from the KeePass application.
However, due to the original KeePass being Windows-specific, I've ...
- 360
1
vote
0
answers
310
views
What exactly happens when you use 2FA with "Password" + "Yubikey HMAC" Login in KeepassXC?
Usecase: KeepassXC is configured with a Passward + Yubikey HMAC.
I am trying to understand the exact steps that happen.
I think the first five Steps are clear:
Open KeepassXC
Enter Password
Select ...
- 21
0
votes
1
answer
551
views
Storing OTP seeds in password manager [duplicate]
I am storing my passwords in a password manager (keepass). Also I am using keepass to set up one-time passwords for some accounts. Keepass is storing the seeds of the OTP's in its database.
If my ...
- 101
2
votes
1
answer
917
views
Why is entropy measured in bits?
I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
- 157
3
votes
1
answer
733
views
Is it not useless to increase iterations in KeePass?
So if increasing the number of iterations makes the computation power needed more in a linear way. Wouldn't that be a small increase compared to even a single more character added to your password?
...
- 171
6
votes
2
answers
2k
views
Keepass' password protection in memory
Plenty of "passwords in memory" and "keepass" related (old) topics in here, but most of them are about how to harden key protection ; plus it seems protection mechanisms by Keepass ...
- 173
5
votes
1
answer
962
views
Relative security of 'offline' vs 'online' password managers
I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
- 51
0
votes
1
answer
313
views
Simplify usage of KeePass or equivalent password managers while preserving security
Situation
I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. ...
- 130
3
votes
2
answers
688
views
How can I safely print a keyfile on paper?
I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery.
How can I create a file that is printable on paper in such a way that I can use ...
- 33
4
votes
0
answers
1k
views
How secure is pass compared to Keepass?
Is pass a real alternative to Keepass in terms of security?
While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
- 249
0
votes
2
answers
2k
views
Which would be the best "keyfile" for KeepassXC and/or Veracrypt?
I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
- 3
1
vote
1
answer
1k
views
What can I do to improve my Keepass XC setup?
I'm planning on using KeePass XC for the first time and am trying to create a setup that:
(1) would prevent hackers from stealing my passwords
(2) would prevent me from losing access to my ...
- 11
1
vote
1
answer
1k
views
Encryption strength veracrypt vs keepass?
can you please explain the strength of veracrypt and keepass compared?
Whats theoretically easier to break if both use the exact same password for their respective containers, the vcrypt or keepass ...
- 483
1
vote
2
answers
1k
views
How well will the max transformation rounds in Keepassx deter an attacker for the next twenty years?
Keepassx lets you decide how many transformations rounds need to be run in order to unlock your Keepass database. In my version of Keepassx (2.0.3) the max value seems to be 999,999,999. With that ...
- 115
0
votes
1
answer
266
views
Is my keepass great? How can I improve it?
Here is my keepass setup:
Cloud
Gmail 1 Google Drive: holds database
Gmail 2 Google Drive: holds key file
Hard Drive
Computer: holds database (leave at home)
USB 1: holds database (always have ...
- 1
4
votes
1
answer
5k
views
new format of keepass (2) database file and hashcat
I created test DB file (.kdbx) using KeePassX, after that used keepass2john Python port from this site, but changed line 88:
index += 2
to
index += 4
because the size of this field is 4 bytes ...
- 41
5
votes
1
answer
3k
views
How secure is KeePass KDBX4 by default?
How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password?
With assumption :
The password length is equal/...
- 53
2
votes
1
answer
227
views
Does knowledge of one or more passwords from my password manager help an attacker crack the master password?
I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
- 1,830
5
votes
2
answers
10k
views
Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?
I use a Windows 10 PC and an Android phone with Keepass.
I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone.
Between the two ...
- 63
3
votes
1
answer
4k
views
KeePass Key File - Does it provide any meaningful security?
KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.
I can see a couple of scenario's:
The database and key are on ...
user198611
2
votes
1
answer
12k
views
Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux
please forgive beginner question.
I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu.
I have been using Keepass2 which is just such an ...
1
vote
1
answer
3k
views
Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]
My KeePassX file has a long and strong password.
I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
- 2,257
1
vote
1
answer
1k
views
iOS 12 built in password manager vs third party apps like Keepass
On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
- 25
1
vote
1
answer
1k
views
KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password
Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know:
Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password?
From what I know, the ...
- 113
3
votes
2
answers
2k
views
Breaking .kdb (KeePass 1.x) file
During a penetration testing lab, I have obtained access to a .kdb file of a KeePass 1.25 (password management).
Therefore I tried to find a way to obtain the file key file or key and after ...
- 1,840
1
vote
2
answers
6k
views
How to crack forgotton KeePass password when knowing most of the password
A few days ago I changed my KeePass password and forgot it unfortunately. It isn't that much different from the previous one, but I kept trying and trying and it says it's incorrect
I found https://...
- 11
5
votes
2
answers
1k
views
How can I be sure my Keepass client is secure?
I've been fiddling with a locally encrypted disk image for years and I think it's finally time to use a password manager. Keepass is what I want to go with but I'm not a fan of the UI of the official ...
- 155
2
votes
1
answer
331
views
Security on passwords stored by Firefox vs password manager
I am wondering about the safety of my passwords stored in FF > 57.
I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm.
Are ...
2
votes
1
answer
10k
views
How secure is Keepass when using mobile apps
Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
- 441
5
votes
2
answers
259
views
Properly use files that have keys
Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep ...
user168799
2
votes
1
answer
2k
views
How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]
I wish to evaluate two different password security options which at first seem to be distinctly different:
a cloud-based password manager
a local (non-cloud) password manager
However, the twist is ...
- 340
0
votes
1
answer
846
views
KeepassXC gpg verification with sig file
I downloaded the KeepassXC .AppImage file and was verifying it using first the .DIGEST file and then .sig file. While I was verifying the download using the .sig file I noticed something strange as I ...
user163206
0
votes
1
answer
443
views
Encryption Key Storage for the Average User
I use KeePass and Veracrypt on my home computer. In addition to a strong password, I also use key files, for example, Veracrypt lets you choose any file on your computer(mp3, jpeg, etc..) as the key. ...
user161164
5
votes
2
answers
1k
views
Security for KeePass Emergencey Sheet
KeePass just introduced the concept of an emergency sheet that can be shared with trusted users. This question might go beyond the scope of this site, but suppose you printed one of these sheets, how ...
user161164
3
votes
1
answer
3k
views
Why do KeePass dabases contain a hash of their master password?
Background
In the article How to Hack KeePass, the author used keepass2john on a KeePass database to extract a hash of its master password.
For the database CrackThis.kdb the extracted hash was (...
- 133
9
votes
1
answer
11k
views
Why doesn't KeePass use two factor / one time password generation to protect the database?
I've read KeePass kinda sorta tries as much as is possible to limit keyloggers (at least on PC).
But since you type in your master database password on many devices many times, there's a huge chance ...
- 193
15
votes
5
answers
7k
views
KeePass security local malware
Can a malware that infected your local computer compromise a KeePass database stored locally in any way?
If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
- 433
13
votes
3
answers
4k
views
How trustful are KeePass plugins?
KeePass is great, I love it but after several years using it, sometimes I wish to install a plugin but I don't because I'm scared of what this plugin can really do without my consent.
The ...
- 281
8
votes
2
answers
2k
views
Safe way to backup Bitcoin hardware wallet
On official site they (Trezor) emphasize that you should never store your recovery seed digitally. But this seems to me absolutely strange. First of all we live in 21st century. And paper (or even ...
- 463
5
votes
3
answers
771
views
Is there a password manager that combines a "master password" solution with a keystore solution?
There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools.
The general idea is that a function hash("my_master_password", "...
- 153
3
votes
2
answers
1k
views
Attacking KeePass
I recently saw this new attack on KeePass (see here and the source code). I don't know how to use this attack (I'm a newbie to these things), so I want to know:
How can this attack be used?
What does ...
user125213
2
votes
0
answers
403
views
Portable offline password manager [closed]
I have an encrypted external hard drive that I want to use as a portable security center.
One of the things I want to do is setup a portable offline password keeper that can run entirely from the ...
- 121
1
vote
2
answers
5k
views
How to securely send passwords using KeePass
I use KeePass to store my passwords and it works great. From time to time, I create users in the network and I need to send them their initial password, which I generate through KeePass.
I usually ...
- 143
1
vote
1
answer
4k
views
Alternatives to bruteforce KeePass Cracker
Recently I have been working on a little project. I have been able to crack my keePass .kdbx file by running a simple brute force attack with the KeePass Cracker and a custom made word list.
This is ...
- 189
1
vote
2
answers
277
views
How to prevent corruption from ruining synced backups
I thought I was being clever keeping my password database stored on dropbox. This is because it's synced to the cloud and multiple computers. But when one got corrupted, I lost everything. (Ok I ...
- 10.1k
1
vote
2
answers
679
views
Will using a keyfile option to open a software such as KeePass defeat keyloggers and screen capture software?
I was investigating the security of keyfiles vs passwords and thinking that possibly the keyfile could bypass keyloggers that might be installed on my machine.
- 11
0
votes
1
answer
2k
views
Security of KeePass and Yubikey OATH-HOTP
How secure is KeePass in addition with a Yubikey with OATH-HOTP?
I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor.
But ...
- 1