Hot answers tagged

43 votes
Accepted

KeePass Vs OneNote

As far as storage is concerned, I think that any correctly encrypted file will have same level of security. The problem is that passwords are meant to be used, and then dedicated password vaults have ...
Serge Ballesta's user avatar
27 votes

KeePass security local malware

Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software ...
Matthew's user avatar
  • 27.4k
19 votes
Accepted

Is keepass random password generator fully secure and trustworthy?

tl;dr: Yes, it's reasonably safe. When an attacker knows you use KeePass, then they might also assume that you use the standard settings for the password generator. That tells them the length and the ...
Philipp's user avatar
  • 49.4k
17 votes

KeePass Vs OneNote

A brief look out there says that it uses AES, which is robust and the exploit tools I see look like they are doing dictionary and brute force attacks, rather than attacking something systematically ...
crovers's user avatar
  • 6,381
16 votes
Accepted

KeePass security local malware

When your computer is compromised, pretty much any defense on it should be considered broken. Security threat models consider this as an out-of-scope scenario - barring very few exceptions (e.g., the ...
Sas3's user avatar
  • 2,658
10 votes

I stored a copy of my KeePass database on a portable hard drive and I lost the drive. Should I worry about that?

TL;DR: You can relax - your database is absolutely secure. Technical details: The encryption used by KeePass is not broken as of today. Brute-Forcing the AES-256 key is infeasible. Assuming your ...
marstato's user avatar
  • 2,315
10 votes

KeePass security local malware

It's worth mentioning that there are settings inside KeePass to help restrict what malware (and you) can do. This lets you, for instance, prevent malware from simply exporting your entire database by ...
Spacedog's user avatar
  • 201
10 votes
Accepted

Keepass' password protection in memory

Question 1: is the above still right on this day? That is the only time the key can be extracted from memory. But if someone has the level of access to access memory, they can compromise your system ...
nobody's user avatar
  • 11.5k
9 votes

KeePass Vs OneNote

Apart from the usability concerns mentioned by @Serge Ballesta in his answer, the following security problems arise: KeePass has a well documented security. They document the Key Derivation Function ...
mat's user avatar
  • 1,272
8 votes

Is there a password manager that combines a "master password" solution with a keystore solution?

Original question With only one master password, for both the final hash and the key store. Your scheme adds no additional security on top of what standard password managers already offer. So lets ...
Anders's user avatar
  • 65.6k
7 votes
Accepted

Is there a password manager that combines a "master password" solution with a keystore solution?

You say you cannot trust a password manager because of the risks inherent to password storage. But I cannot really understand where is the improvement with your solutions: Confidentiality: A ...
Serge Ballesta's user avatar
6 votes
Accepted

What are possible methods for calculating password entropy?

The proper way to calculate password entropy is to look at the password generation method, evaluate how much entropy is involved in the password generation method, and then evaluate how much of that ...
Lie Ryan's user avatar
  • 31.4k
6 votes
Accepted

Is it safe to leave Keepass always opened on a computer?

It is safe if your computer is safe from unauthorized access. This includes malware. If your computer is not physically safe, then no, anyone can access your Keepass. If your computer has malware on ...
d1str0's user avatar
  • 2,348
5 votes

Storing KeePass database in cloud. How safe?

I would suggest a solution that involves the following: KeePass Database file stored on local computer with Full Disk encryption (e.g. Veracrypt) KeePass Key File stored on an external USB disk Cloud ...
user172957's user avatar
5 votes

How to securely send passwords using KeePass

The usual way to handle this is to set a random password, force a password change at first connection and send that password to the user. More sophisticated systems will force the first logon and ...
Stephane's user avatar
  • 18.7k
5 votes
Accepted

How trustful are KeePass plugins?

So in short, the only way to ensure an optimum security with the KeePass plugins is to review their codes by yourself. The only problem is that some of them are open source, some others are not. ...
Jérôme MEVEL's user avatar
5 votes

KeePass security local malware

Attacks on KeePass Can a malware that infected your local computer compromise a KeePass database stored locally by any way? If you don't open it, they can only snatch the database file and try to ...
user2428118's user avatar
  • 2,786
5 votes
Accepted

How can I be sure my Keepass client is secure?

How do you know how to trust any given KeePass implementation? The same ways you know how to trust any software. For me, these are factors I consider: Open Source All of the major ports are open. ...
Ben's user avatar
  • 4,022
5 votes
Accepted

How can I safely print a keyfile on paper?

My suggestion would be to directly print Base64 and print a QR-code of the same Base64. The plain base64 is a tedious fallback if all else fails. You could also print it using OCR fonts for better ...
user10216038's user avatar
  • 8,113
4 votes

What are possible methods for calculating password entropy?

Data entropy depends on the observer - there is no absolute measurement of entropy. It's even questionable as to whether or not anything in the universe it at all random, and "randomness" (or, more ...
iAdjunct's user avatar
  • 1,700
4 votes
Accepted

How to eliminate data leaks when accessing encrypted data?

Does method 2 address data leak vulnerabilities present when accessing files via method 1? Not at all. It just ensures that the already-protected VeraCrypt container will be saved to an encrypted ...
techraf's user avatar
  • 9,159
4 votes
Accepted

Is KeePass # of rounds relevant if you use a key file as master password?

The point of using the key file in KeePass is that you can keep the file out of reach (on external media) and connect it only when you need to unlock the database. As you consider phones, you likely ...
techraf's user avatar
  • 9,159
4 votes

How trustful are KeePass plugins?

A KeePass plugin can do pretty much anything that KeePass itself can, it is effectively just a .NET library. AFAIK, there is no sandboxing at all to a KeePass plugin. So unless you decompile and do a ...
Lie Ryan's user avatar
  • 31.4k
4 votes
Accepted

Why doesn't KeePass use two factor / one time password generation to protect the database?

Nobody has figured out how to involve OTP with encryption that materially improves security. It's important to remember that KeePass's master password is used to derive encryption key, so it is ...
Lie Ryan's user avatar
  • 31.4k
4 votes
Accepted

Why do KeePass dabases contain a hash of their master password?

The answer is in the the source code of keepass2john.c that you linked, from lines 156 to 163. The only hash included is the hash of the plaintext of the database. I let you read what the other fields ...
A. Hersean's user avatar
  • 10.6k
4 votes
Accepted

Security for KeePass Emergencey Sheet

The answer lies in the question of what is the risks and threats? A regular person, who doesn't have any specific threat to their safety/security likely is well served by having a fire and water-...
MikeP's user avatar
  • 1,209
4 votes
Accepted

How secure is Keepass when using mobile apps

The problem with any application that can access your password safe contents is that it could potentially do anything with the passwords: send them to a server, save them on your hard drive in plain ...
Matthew's user avatar
  • 27.4k
4 votes
Accepted

Breaking .kdb (KeePass 1.x) file

There is no short cut. Brute forcing it is the way to go.
Joe M's user avatar
  • 3,002
4 votes

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

In my opinion "Keepass 2 using OTP" can not be "secure". Why? OTP can not be used to encrypt data Keepass encrypts data and the problem with encrypted data is, that you encrypt the data because you ...
cornelinux's user avatar
  • 2,053
4 votes
Accepted

Which is more secure Yubikey + Keepass using Challenge/Response or Yubikey + Keepass using OTP?

One important difference between OTPs and challenge/response schemes is that the first can be spoofed, and the second cannot. Suppose somebody sets up a phishing UI for KeePass, and you enter your ...
CBHacking's user avatar
  • 47.5k

Only top scored, non community-wiki answers of a minimum length are eligible