We changed our privacy policy. Read more.

Questions tagged [keepass]

KeePass is a free, open source password manager for Windows. It has unofficial ports for Linux, Mac OS X, Android, and iPhone. Passwords are protected with strong encryption keyed with a master password.

Filter by
Sorted by
Tagged with
0
votes
1answer
106 views

Why is entropy measured in bits?

I use KeePassXC to generate and store passwords. For example, generating a password with a length of 128 characters without using the extended ASCII character table, the entropy is about 770 - 800 ...
0
votes
0answers
36 views

Password Progress running John the Ripper

the old notebook i'm running John at is really slow. It runs now for over 10 days to get the password from my own (i swear its my own) keepass database. I even don't need the whole password, the first ...
2
votes
1answer
189 views

Is it not useless to increase iterations in KeePass?

So if increasing the number of iterations makes the computation power needed more in a linear way. Wouldn't that be a small increase compared to even a single more character added to your password? ...
6
votes
1answer
1k views

Keepass' password protection in memory

Plenty of "passwords in memory" and "keepass" related (old) topics in here, but most of them are about how to harden key protection ; plus it seems protection mechanisms by Keepass ...
4
votes
1answer
430 views

Relative security of 'offline' vs 'online' password managers

I am a long-standing KeePass user, but I find its browser integration and Android apps a bit ropey, and certainly harder work than a cloud-based solution such as Lastpass or Bitwarden. I have been ...
0
votes
0answers
48 views

Is there anyway to recover wrong KeePass 2 password tries?

I often have trouble logging into KeePass 2 (now 2.46). I would really like once logged to know what it thinks I typed for incorrect passwords. Is it possible to find out?
0
votes
1answer
99 views

Simplify usage of KeePass or equivalent password managers while preserving security

Situation I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. ...
3
votes
2answers
302 views

How can I safely print a keyfile on paper?

I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery. How can I create a file that is printable on paper in such a way that I can use ...
1
vote
0answers
484 views

How secure is pass compared to Keepass?

Is pass a real alternative to Keepass in terms of security? While Keepass has its own built-in encryption, pass relies on GPG to secure your passwords. GPG is obviously recognized as providing ...
0
votes
1answer
347 views

Which would be the best "keyfile" for KeepassXC and/or Veracrypt?

I am a Mac user. I opened a keyfile generated by Veracrypt and one generated by KeepassXC. The texts in both of them were quite short. Which keyfile is best (i.e., most random and harder to break ...
0
votes
1answer
565 views

What can I do to improve my Keepass XC setup?

I'm planning on using KeePass XC for the first time and am trying to create a setup that: (1) would prevent hackers from stealing my passwords (2) would prevent me from losing access to my ...
1
vote
1answer
741 views

Encryption strength veracrypt vs keepass?

can you please explain the strength of veracrypt and keepass compared? Whats theoretically easier to break if both use the exact same password for their respective containers, the vcrypt or keepass ...
1
vote
2answers
253 views

How well will the max transformation rounds in Keepassx deter an attacker for the next twenty years?

Keepassx lets you decide how many transformations rounds need to be run in order to unlock your Keepass database. In my version of Keepassx (2.0.3) the max value seems to be 999,999,999. With that ...
0
votes
1answer
184 views

Is my keepass great? How can I improve it?

Here is my keepass setup: Cloud Gmail 1 Google Drive: holds database Gmail 2 Google Drive: holds key file Hard Drive Computer: holds database (leave at home) USB 1: holds database (always have ...
4
votes
1answer
3k views

new format of keepass (2) database file and hashcat

I created test DB file (.kdbx) using KeePassX, after that used keepass2john Python port from this site, but changed line 88: index += 2 to index += 4 because the size of this field is 4 bytes ...
4
votes
1answer
2k views

How secure is KeePass KDBX4 by default?

How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password? With assumption : The password length is equal/...
2
votes
1answer
141 views

Does knowledge of one or more passwords from my password manager help an attacker crack the master password?

I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
5
votes
2answers
6k views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
3
votes
1answer
2k views

KeePass Key File - Does it provide any meaningful security?

KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much. I can see a couple of scenario's: The database and key are on ...
2
votes
1answer
10k views

Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux

please forgive beginner question. I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu. I have been using Keepass2 which is just such an ...
1
vote
1answer
2k views

Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]

My KeePassX file has a long and strong password. I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
1
vote
1answer
1k views

iOS 12 built in password manager vs third party apps like Keepass

On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
1
vote
1answer
828 views

KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password

Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know: Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password? From what I know, the ...
2
votes
2answers
1k views

Breaking .kdb (KeePass 1.x) file

During a penetration testing lab, I have obtained access to a .kdb file of a KeePass 1.25 (password management). Therefore I tried to find a way to obtain the file key file or key and after ...
1
vote
2answers
4k views

How to crack forgotton KeePass password when knowing most of the password

A few days ago I changed my KeePass password and forgot it unfortunately. It isn't that much different from the previous one, but I kept trying and trying and it says it's incorrect I found https://...
5
votes
2answers
962 views

How can I be sure my Keepass client is secure?

I've been fiddling with a locally encrypted disk image for years and I think it's finally time to use a password manager. Keepass is what I want to go with but I'm not a fan of the UI of the official ...
2
votes
1answer
245 views

Security on passwords stored by Firefox vs password manager

I am wondering about the safety of my passwords stored in FF > 57. I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm. Are ...
2
votes
1answer
9k views

How secure is Keepass when using mobile apps

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
5
votes
2answers
181 views

Properly use files that have keys

Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep ...
2
votes
1answer
2k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
0
votes
2answers
537 views

KeepassXC gpg verification with sig file

I downloaded the KeepassXC .AppImage file and was verifying it using first the .DIGEST file and then .sig file. While I was verifying the download using the .sig file I noticed something strange as I ...
0
votes
1answer
357 views

Encryption Key Storage for the Average User

I use KeePass and Veracrypt on my home computer. In addition to a strong password, I also use key files, for example, Veracrypt lets you choose any file on your computer(mp3, jpeg, etc..) as the key. ...
5
votes
2answers
855 views

Security for KeePass Emergencey Sheet

KeePass just introduced the concept of an emergency sheet that can be shared with trusted users. This question might go beyond the scope of this site, but suppose you printed one of these sheets, how ...
3
votes
1answer
2k views

Why do KeePass dabases contain a hash of their master password?

Background In the article How to Hack KeePass, the author used keepass2john on a KeePass database to extract a hash of its master password. For the database CrackThis.kdb the extracted hash was (...
9
votes
1answer
10k views

Why doesn't KeePass use two factor / one time password generation to protect the database?

I've read KeePass kinda sorta tries as much as is possible to limit keyloggers (at least on PC). But since you type in your master database password on many devices many times, there's a huge chance ...
16
votes
5answers
7k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
13
votes
3answers
3k views

How trustful are KeePass plugins?

KeePass is great, I love it but after several years using it, sometimes I wish to install a plugin but I don't because I'm scared of what this plugin can really do without my consent. The ...
8
votes
2answers
2k views

Safe way to backup Bitcoin hardware wallet

On official site they (Trezor) emphasize that you should never store your recovery seed digitally. But this seems to me absolutely strange. First of all we live in 21st century. And paper (or even ...
5
votes
3answers
638 views

Is there a password manager that combines a "master password" solution with a keystore solution?

There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools. The general idea is that a function hash("my_master_password", "...
3
votes
2answers
1k views

Attacking KeePass

I recently saw this new attack on KeePass (see here and the source code). I don't know how to use this attack (I'm a newbie to these things), so I want to know: How can this attack be used? What does ...
2
votes
0answers
348 views

Portable offline password manager [closed]

I have an encrypted external hard drive that I want to use as a portable security center. One of the things I want to do is setup a portable offline password keeper that can run entirely from the ...
1
vote
2answers
4k views

How to securely send passwords using KeePass

I use KeePass to store my passwords and it works great. From time to time, I create users in the network and I need to send them their initial password, which I generate through KeePass. I usually ...
1
vote
1answer
4k views

Alternatives to bruteforce KeePass Cracker

Recently I have been working on a little project. I have been able to crack my keePass .kdbx file by running a simple brute force attack with the KeePass Cracker and a custom made word list. This is ...
1
vote
2answers
219 views

How to prevent corruption from ruining synced backups

I thought I was being clever keeping my password database stored on dropbox. This is because it's synced to the cloud and multiple computers. But when one got corrupted, I lost everything. (Ok I ...
1
vote
2answers
608 views

Will using a keyfile option to open a software such as KeePass defeat keyloggers and screen capture software?

I was investigating the security of keyfiles vs passwords and thinking that possibly the keyfile could bypass keyloggers that might be installed on my machine.
0
votes
1answer
2k views

Security of KeePass and Yubikey OATH-HOTP

How secure is KeePass in addition with a Yubikey with OATH-HOTP? I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor. But ...
1
vote
1answer
1k views

Threats due to a stolen password db file (e.g. keepass)

If someonelse could get your password db file (e.g. .kdbx file for keepass), maybe due to a hacking attack, how threaten is your security in fact? Of course this is a problem and you should change ...
20
votes
5answers
11k views

KeePass Vs OneNote

In my personal life, I use KeePassX to generate/store all my passwords. I have seen some people use a password protected OneNote section. Does the password protected OneNote section provide a ...
0
votes
2answers
164 views

Password manager database and keyfile

I'm trying to store passwords more securely in my department. I was thinking about using Keepass, giving each of my colleagues a personal password database and require a simple password (they won't ...
2
votes
2answers
1k views

Should I run KeePass as administrator?

If I run KeePass as a normal application, any other application (e.g. browser) can do code injection and get my passwords. However if I run KeePass with admin rights, my browser cannot get into it. ...