5 ms·

For reference, the actual official site is https://keepass.info/ https://keepass.info/

username223 7y ago
And this is why you buy the .com domain for your company, instead of some weird one like .info, .io, or .pizza: most people assume that's where they'll find your company. If someone's squatting it, you can buy it from them, or just come up with a new nonsense word for your company. Maybe developers are getting used to the `getQwerpy.io` convention, but I don't see it catching on more broadly.
- antsar 7y ago
  Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).
  - vikramkr 7y ago
    Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...
    - Macha 7y ago
      Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.
      - mywittyname 7y ago
        IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.
        stordoff 7y ago
        According to https://keepass.info/help/kb/sec_issues.html https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one. It has however been resolved: > the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.
  - magicalhippo 7y ago
    The domain name provider I use[1] takes $2 less per year for a .com compared to a .info. [1]: https://domainname.shop/register https://domainname.shop/register
    - dmix 7y ago
      That page says €9.95/yr for .com which is $11.17 USD...
      - magicalhippo 7y ago
        $11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.
    - antsar 7y ago
      For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.
      - munk-a 7y ago
        So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.
        antsar 7y ago
        At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.
magashna 7y ago
oof, .info and .biz are almost always red flags
- Waterluvian 7y ago
  Faced with the .info and .com I would have bet all my money that .com was the legit one.
  - DangitBobby 7y ago
    +10000 bonus points since the malicious group made the UI feel more modern on .com than the .info page.
  - Mirioron 7y ago
    On the other hand, the .com page is page 2 of Google results, while .info is the first result.
    - stordoff 7y ago
      Not for me - excluding ads, Keepass.com is the fourth result (KeePass.info, Sourceforge, Wikipedia, "People also ask" infobox, then Keepass.com).
covertbeginner 7y ago
What about https://www.keepassx.org/downloads https://www.keepassx.org/downloads ?

And this is why you buy the .com domain for your company, instead of some weird one like .info, .io, or .pizza: most people assume that's where they'll find your company. If someone's squatting it, you can buy it from them, or just come up with a new nonsense word for your company. Maybe developers are getting used to the `getQwerpy.io` convention, but I don't see it catching on more broadly.

antsar 7y ago
Good idea for a company. Tough if you're a FOSS project and the domain costs $xx,xxx (almost any desireable dot-com does).
- vikramkr 7y ago
  Change the name. Especially if you're a security oriented service and not having the dot com opens you up to this sort of, I guess its phishing? .info and all are basically active red flags, especially for a security oriented project...
  - Macha 7y ago
    Honestly the Keepass maintainers have had enough basic issues with website security (see how long they held out on https for update downloads), that I use KeepassXC even on Windows these days. I figure there's enough eyes on the kdbx 4 protocol that it's safe, but the keepassxc team feels better organised.
    - mywittyname 7y ago
      IIRC, the update was over HTTPS, just the "check for new version" call was to HTTP.
      - stordoff 7y ago
        According to https://keepass.info/help/kb/sec_issues.html https://keepass.info/help/kb/sec_issues.html, it doesn't auto-update - it just displays that a new version is available. Enabling a man-in-the-middle to display a fake update notification, when there are fake versions of Keepass floating around and the user could easily slip up (and the MITM could guide the user towards a fake version) still feels like a hole, albeit a minor one. It has however been resolved: > the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.
- magicalhippo 7y ago
  The domain name provider I use[1] takes $2 less per year for a .com compared to a .info. [1]: https://domainname.shop/register https://domainname.shop/register
  - dmix 7y ago
    That page says €9.95/yr for .com which is $11.17 USD...
    - magicalhippo 7y ago
      $11.95 vs $13.95 for me. Similar in my local currency if I go to their regional page.
  - antsar 7y ago
    For an unregistered .com. Most desirable .com's have been squatted, and the squatters want five to six digits for the domain. The business model deserves a fiery death, yet it thrives.
    - munk-a 7y ago
      So cities recently have been toying with vacancy taxes that target rich people using prime real estate speculatively or who wish to reserve a unit without anyone having lived there for cultural reasons - maybe that's the sort of tactic we need to examine with domains, some sort of creative usage bar that utilizes distinctness from other domains to detect squatting and levy a fee.
      - antsar 7y ago
        At scale, distinguishing a squatter's markov-generated WordPress landing page from a genuine pre-product startup in stealth mode sounds like a Hard Problem. On the other hand someone with 10,000 domains and zero business plans is obviously a squatter. There's probably a way to draw the line that's viable to enforce.

magashna 7y ago

oof, .info and .biz are almost always red flags

Waterluvian 7y ago
Faced with the .info and .com I would have bet all my money that .com was the legit one.
- DangitBobby 7y ago
  +10000 bonus points since the malicious group made the UI feel more modern on .com than the .info page.
- Mirioron 7y ago
  On the other hand, the .com page is page 2 of Google results, while .info is the first result.
  - stordoff 7y ago
    Not for me - excluding ads, Keepass.com is the fourth result (KeePass.info, Sourceforge, Wikipedia, "People also ask" infobox, then Keepass.com).

covertbeginner 7y ago

What about https://www.keepassx.org/downloads https://www.keepassx.org/downloads ?