The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [keepass]

KeePass is a free, open source password manager for Windows. It has unofficial ports for Linux, Mac OS X, Android, and iPhone. Passwords are protected with strong encryption keyed with a master password.

Filter by
Sorted by
Tagged with
2
votes
1answer
116 views

new format of keepass (2) database file and hashcat

I created test DB file (.kdbx) using KeePassX, after that used keepass2john Python port from this site, but changed line 88: index += 2 to index += 4 because the size of this field is 4 bytes ...
3
votes
1answer
300 views

How secure is KeePass KDBX4 by default?

How secure is KeePass KDBX4 by default if someone obtain the .kdbx file and attempt to brute-force it without knowing any hint of the master password? With assumption : The password length is equal/...
2
votes
1answer
106 views

Does knowledge of one or more passwords from my password manager help an attacker crack the master password?

I use a keepass password manager with a master password of more than 100 bits. I keep the password file in cloud storage. If an attacker has my password file, it should be difficult for them to ...
1
vote
2answers
758 views

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

I use a Windows 10 PC and an Android phone with Keepass. I would like to add a second factor on top of my master password that works with both Windows 10 and my Android phone. Between the two ...
3
votes
1answer
469 views

KeePass Key File - Does it provide any meaningful security?

KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much. I can see a couple of scenario's: The database and key are on ...
1
vote
1answer
6k views

Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux

please forgive beginner question. I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu. I have been using Keepass2 which is just such an ...
1
vote
1answer
1k views

Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]

My KeePassX file has a long and strong password. I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
1
vote
1answer
866 views

iOS 12 built in password manager vs third party apps like Keepass

On my personal computers I have always used Keepass2, which however was a bit of a pain to set up with my browser. On my iPhone I have now started to use the built-in password manager (iOS 12 -> ...
1
vote
1answer
300 views

KeePassXC & Yubikey HMAC-SHA-1 vs 40+ Character Password

Looking at the implementation of the Yubikey 4 HMAC-SHA1 mode for KeePassXC, I want to know: Isn't the HMAC-SHA1 challenge response less secure than a 40+ character password? From what I know, the ...
2
votes
2answers
634 views

Breaking .kdb (KeePass 1.x) file

During a penetration testing lab, I have obtained access to a .kdb file of a KeePass 1.25 (password management). Therefore I tried to find a way to obtain the file key file or key and after ...
1
vote
1answer
1k views

How to crack forgotton KeePass password when knowing most of the password

A few days ago I changed my KeePass password and forgot it unfortunately. It isn't that much different from the previous one, but I kept trying and trying and it says it's incorrect I found https://...
4
votes
2answers
578 views

How can I be sure my Keepass client is secure?

I've been fiddling with a locally encrypted disk image for years and I think it's finally time to use a password manager. Keepass is what I want to go with but I'm not a fan of the UI of the official ...
1
vote
1answer
169 views

Security on passwords stored by Firefox vs password manager

I am wondering about the safety of my passwords stored in FF > 57. I guess passwords stored in a Keepass database file are safe against cracking, as much as possible given its AES algorithm. Are ...
2
votes
1answer
6k views

How secure is Keepass when using mobile apps

Keepass appears to be very secure, because it is open-source and the code is examined by a lot of independent people. Furthermore the database which holds all passwords is stored wherever the user ...
5
votes
2answers
136 views

Properly use files that have keys

Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep ...
2
votes
1answer
1k views

How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

I wish to evaluate two different password security options which at first seem to be distinctly different: a cloud-based password manager a local (non-cloud) password manager However, the twist is ...
0
votes
1answer
280 views

KeepassXC gpg verification with sig file

I downloaded the KeepassXC .AppImage file and was verifying it using first the .DIGEST file and then .sig file. While I was verifying the download using the .sig file I noticed something strange as I ...
0
votes
1answer
250 views

Encryption Key Storage for the Average User

I use KeePass and Veracrypt on my home computer. In addition to a strong password, I also use key files, for example, Veracrypt lets you choose any file on your computer(mp3, jpeg, etc..) as the key. ...
5
votes
2answers
590 views

Security for KeePass Emergencey Sheet

KeePass just introduced the concept of an emergency sheet that can be shared with trusted users. This question might go beyond the scope of this site, but suppose you printed one of these sheets, how ...
3
votes
1answer
1k views

Why do KeePass dabases contain a hash of their master password?

Background In the article How to Hack KeePass, the author used keepass2john on a KeePass database to extract a hash of its master password. For the database CrackThis.kdb the extracted hash was (...
5
votes
1answer
6k views

Why doesn't KeePass use two factor / one time password generation to protect the database?

I've read KeePass kinda sorta tries as much as is possible to limit keyloggers (at least on PC). But since you type in your master database password on many devices many times, there's a huge chance ...
16
votes
5answers
6k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
10
votes
2answers
2k views

How trustful are KeePass plugins?

KeePass is great, I love it but after several years using it, sometimes I wish to install a plugin but I don't because I'm scared of what this plugin can really do without my consent. The ...
7
votes
2answers
1k views

Safe way to backup Bitcoin hardware wallet

On official site they (Trezor) emphasize that you should never store your recovery seed digitally. But this seems to me absolutely strange. First of all we live in 21st century. And paper (or even ...
5
votes
3answers
553 views

Is there a password manager that combines a “master password” solution with a keystore solution?

There are many posts online debating the merits of "master password" or "deterministic, site-specific" password generation tools. The general idea is that a function hash("my_master_password", "...
3
votes
2answers
669 views

Attacking KeePass

I recently saw this new attack on KeePass (see here and the source code). I don't know how to use this attack (I'm a newbie to these things), so I want to know: How can this attack be used? What does ...
2
votes
0answers
316 views

Portable offline password manager [closed]

I have an encrypted external hard drive that I want to use as a portable security center. One of the things I want to do is setup a portable offline password keeper that can run entirely from the ...
1
vote
2answers
2k views

How to securely send passwords using KeePass

I use KeePass to store my passwords and it works great. From time to time, I create users in the network and I need to send them their initial password, which I generate through KeePass. I usually ...
1
vote
1answer
3k views

Alternatives to bruteforce KeePass Cracker

Recently I have been working on a little project. I have been able to crack my keePass .kdbx file by running a simple brute force attack with the KeePass Cracker and a custom made word list. This is ...
1
vote
2answers
162 views

How to prevent corruption from ruining synced backups

I thought I was being clever keeping my password database stored on dropbox. This is because it's synced to the cloud and multiple computers. But when one got corrupted, I lost everything. (Ok I ...
1
vote
2answers
394 views

Will using a keyfile option to open a software such as KeePass defeat keyloggers and screen capture software?

I was investigating the security of keyfiles vs passwords and thinking that possibly the keyfile could bypass keyloggers that might be installed on my machine.
0
votes
1answer
1k views

Security of KeePass and Yubikey OATH-HOTP

How secure is KeePass in addition with a Yubikey with OATH-HOTP? I read in Yubikey with KeePass using challenge-response vs OATH-HOTP that with OATH-HOTP there isn´t added a real second factor. But ...
1
vote
1answer
874 views

Threats due to a stolen password db file (e.g. keepass)

If someonelse could get your password db file (e.g. .kdbx file for keepass), maybe due to a hacking attack, how threaten is your security in fact? Of course this is a problem and you should change ...
20
votes
5answers
10k views

KeePass Vs OneNote

In my personal life, I use KeePassX to generate/store all my passwords. I have seen some people use a password protected OneNote section. Does the password protected OneNote section provide a ...
0
votes
2answers
149 views

Password manager database and keyfile

I'm trying to store passwords more securely in my department. I was thinking about using Keepass, giving each of my colleagues a personal password database and require a simple password (they won't ...
2
votes
2answers
679 views

Should I run KeePass as administrator?

If I run KeePass as a normal application, any other application (e.g. browser) can do code injection and get my passwords. However if I run KeePass with admin rights, my browser cannot get into it. ...
1
vote
2answers
598 views

How to eliminate data leaks when accessing encrypted data?

Goal: Encrypt/secure and access sensitive files (PDFs, etc.) locally. Method 1: Store files in a VeraCrypt file-hosted volume (container). Concern: Data Leaks. When mounting and reading files from ...
2
votes
1answer
1k views

Is KeePass # of rounds relevant if you use a key file as master password?

I used to have my database set to 20.000.000 key transformation rounds and it would be fast enough on my PC but I found it takes too much time on my phones so I went to lower it and couldn't notice ...
1
vote
0answers
139 views

Right mechanism & workflow for repeated replication of passwords from LastPass to KeePass?

A lot of us currently use LastPass for the easy management, access and input of passwords for applications and websites. Now, there are some people who are obsessive about not leaving it out to a ...
2
votes
3answers
447 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
5
votes
4answers
751 views

What are possible methods for calculating password entropy?

I noticed there are tons of questions and answers about password entropy on this forum, some even suggesting formulas for calculating it. None did answer my exact question. What are possible or ...
4
votes
1answer
248 views

Protecting against specialized Keepass attacks

If you look at the KeePass security information, it says: However in all the questions above we're assuming that there's a spyware program running on the system that's specialized on attacking ...
0
votes
1answer
412 views

KeePass - Backup to Telegram? [closed]

I am looking for ways to backup my KeePass file to prevent loss. Of course, I saved it to my computer and my phone. But what if I lose access to my computer and my phone at once? Where should I back ...
7
votes
1answer
831 views

I stored a copy of my KeePass database on a portable hard drive and I lost the drive. Should I worry about that?

I've been using KeePass for years, and I have a lot of accounts. I need to access them anywhere I work, so I store one copy of my database on a portable hard drive. The drive isn't encrypted. The ...
3
votes
2answers
4k views

How does KEEPASS store images, videos and attached documents/items? [duplicate]

I have read quite a bit about KEEPASS and how it encrypts passwords. However, the more I read about it, the more I find how it generates and stores passwords - the methodology provided as well as the ...
3
votes
2answers
1k views

Is it safe to leave Keepass always opened on a computer?

I often need to get several passwords from my Keepass during the same day and I find myself having to open it and input the master password every single time, which is awfully laborious. The obvious ...
3
votes
1answer
979 views

Where to save Keepass' file? [closed]

Using Keepass since a year ago, been told it's an excellent method to store one's passwords. But what is the best location to save Keepass' file (the file where all password are stored and that you ...
3
votes
1answer
685 views

Password manager: should key file be stored on a different device than password db file (even if master pw used)?

Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also? For example I save my .kdbx to dropbox as a means to ...
3
votes
1answer
692 views

When using Dropbox to sync Keepass db, is it ok to open it in synced folder?

I'm going to be storing a Keepass 2 database file (.kdbx) in a local folder that's synced by Dropbox. Is it safe to use Keepass to open the database directly considering everything in the folder is ...
11
votes
2answers
8k views

Yubikey with KeePass using challenge-response vs OATH-HOTP

i got my YubiKey 4 today and first tried it to use KeePass with OATH-HOTP (OtpKeyProv plugin). My Configuration was 3 OTPs with look-ahead count = 0. It was not working that good because sometimes the ...