7 ms·

For anyone confused by this Twitter sound bite, the story is that there are 2 main sites from which you can download KeePass Password Safe (the free, open-sourc

For anyone confused by this Twitter sound bite, the story is that there are 2 main sites from which you can download KeePass Password Safe (the free, open-source password manager): - https://keepass.info/ https://keepass.info/ is the official site, which ironically uses a suspicious-looking .info top-level domain, but is in fact the legitimate source - https://keepass.com/ https://keepass.com/ is an unofficial site which the Twitter article is reporting as spreading malware, but has somehow obtained the more legitimate-sounding .com top-level domain And by the way, both of these sites come up on the first page of a Google search for "KeePass".

hombre_fatal 7y ago
Not owning the .com, letting this happen, and then letting your users get fucked for a year is so incompetent that it's less of a reach to assume the Keepass devs are simply in on it. If you're buying a .info or adding "Origin" after your name, then it's time for a rebrand. You scrape together pennies in your stubbornness at the massive expense of filling the coffers of the bad actors and screwing your users with confusion. Especially for security software.
- mysterypie 7y ago
  At least a little bit of criticism should go to Google Search as well. Isn't it their mission to show users useful search results? Is there any user that would prefer the fake malware site over the legitimate site? KeePass is a popular piece of software, not an obscure item to search for. And it seems like it's been going on for many months, plenty of time to make Google's algorithms respond (if they wanted to).
  - hombre_fatal 7y ago
    One of the incredible perks of getting your phishing/malware site on the .com tld of your target website is the amount of people who will visit your site directly without even going through google. Also, in my experience, Google is very receptive to and decisive on phishing and malware complaints. I've worked on websites that are constant phishing/malware targets and Google moved quickly with us on getting that "this is a malicious website" splash page into Chrome. Since this has been going on for a year, I'd be shocked if the Keepass people even tried. Not even a mention of it on their homepage to help their users pick the legit one?
  - satya71 7y ago
    I'm sure being mentioned on HN has now pushed the phishing site higher in Google rankings
  - slig 7y ago
    My take: a considerable amount of users see the .com on SERP, and click on it over the .info. Google algorithm then increases the ranking of the .com even more because that's where users go and stay (i.e, they don't bounce back to the search).
- feanaro 7y ago
  I'm not sure I'm buying into this .com elitism. In the end, it's a TLD like any other and its presence does not guarantee that your trust is warranted, as this very case shows. It cannot replace actual verification and vetting of the sources you're installing software from. An acknowledgement of the situation on the official site would be nice, though.
  - hombre_fatal 7y ago
    You don't take phishing/malware or your users seriously enough if you think "tld elitism" is a talking point here. See my sibling post.
    - HunOL 7y ago
      Well, keepass.com was registered in 2005, and keepass.info in 2006.
    - feanaro 7y ago
      Well, it is TLD elitism. Sometimes acquiring a domain is not an option. Sometimes you can lose domains. What then? Nothing can replace common sense and critical thinking when installing software from the internet. In the end, everything on the internet is potentially untrusted and blindly looking for ".com" is just a dumb strategy if your goal is not to get pwned. I really cannot bring myself to consider not acquiring <software_name>.com a failure of the software package creator. As I said, if they are aware of a currently on-going phishing attempt that is masquerading as their own software, a prominent tip on their actual website would be nice. The namespace is finite and not every website can be expected to be under .com. Also, the trustworthiness of a TLD is itself a fad, a fashion that changes over time. See: the popularity of .io.
- Datenstrom 7y ago
  I agree with feanaro, users should not trust .com over any other tld and if many of them need to touch a hot stove to let this sink in then so be it. Also, I don't think anything that has any cost at all should be expected of any open source project unless you are paying them.
  - hombre_fatal 7y ago
    I think that's a very sad and hostile way to treat people not as tech savvy as you. You talk about how users should do their own research, yet nobody at Keepass could even be bothered to update their homepage to help users make the disambiguation. Has Keepass done anything about this over the last year? Keepass' last release was 8 days ago. What even is the point of pushing another commit until you've at least done the bare minimum to help your users? What even is the bedrock purpose of this software at that point? Isn't the goal a password manager to help good folks avoid getting pwned by bad guys in the first place? Yet they now have zero skin in the game when bad guys use their image to pwn their own users? I just see bizarre incongruence. Like working hard to ship releases because that's the dedication your users deserve, gosh darnit, while your website has been compromised and serving different binaries for years.
    - Groxx 7y ago
      >I think that's a very sad and hostile way to treat people not as tech savvy as you. To some degree, agreed. To some degree, this is the way the world works and protecting them earlier increases the risk that they'll make a big mistake later. Potayto, potahto. The underlying system is still so messed up that safety here is literally impossible, and there's no alternative.
    - Datenstrom 7y ago
      I don't mean to be harsh that is just how people learn. It is something false about the world many people believe to be true and people learn from experience. I'm not sure the target audience for Keepass is anyone but tech savvy individuals either, I certainly don't know any non tech people that use it only LastPass and others like it. I touched a hot (wood) stove when I was a kid by the way.
- Fnoord 7y ago
  > Not owning the .com, letting this happen, and then letting your users get fucked for a year is so incompetent that it's less of a reach to assume the Keepass devs are simply in on it. > If you're buying a .info or adding "Origin" after your name, then it's time for a rebrand. You scrape together pennies in your stubbornness at the massive expense of filling the coffers of the bad actors and screwing your users with confusion. Especially for security software. So, apparently, according to you, not owning the .com equivalent to your non-.com domain means you're incompetent. Has it ever occurred to you that not everyone is from the USA? If you're supposed to own the .com domain anyway then why ever bother with non-.com domains? All non-.com domains are obsolete according to your reasoning, including .net and .org and CCTLDs. Also, this is non-commercial, free as in beer, FOSS. Where was your donation to the project?
  - deleted 7y ago
    [deleted]
  - hombre_fatal 7y ago
    Just to be clear, you quoted me enumerating a sequence of three things that together informed my judgement, yet you tried to refute my judgement by only responding to one of those things and thus mischaracterized my criticism in that process. Also, I think indifference is a better accusation here than incompetence. If I had to summarize my point of view across the various posts I've made here, it's that I think they are failing all the good folks who made the mistake of looking up Keepass after hearing that it would help them take an important step of cyber security in their life, getting fooled by an imposter, and getting pwned.
    - Fnoord 7y ago
      "They're misquoting me! This is unfair!" Well, that is to keep it brief because there's not much to refute on the other two 'things'... > letting this happen, and then letting your users get fucked for a year Is out of their control. They're not responsible for Keepass.com. That's both simple and obvious. Apparently, if they put up some kind of banner on their website it'd be all cool and dandy? Do you feel the same about uBlock Origin? Let's get this straight. That uBlock Origin warns users that ublock.org is fake is a service. They do not owe you that service. They owe you two things: jack and squat. You sound like you're entitled, but I ask you again: what did you contribute to make the problem go away? Did you donate money to the problem? Did you contact the project?
- Mirioron 7y ago
  You're free to donate them money so they can do that.
- tptacek 7y ago
  KeePass is an open source project. There's no "letting" involved: they don't have the domain name. Please be more careful about accusing people of malfeasance. You could have written a good version of this comment that said something like "KeePass should rename, that's in the best interests of its users". Try to write constructively here.
  - stingraycharles 7y ago
    I agree. To turn this thread into something more constructive: it might be a good idea to report it to https://safebrowsing.google.com/safebrowsing/report_phish/ https://safebrowsing.google.com/safebrowsing/report_phish/ to make sure it gets Google's attention, and hopefully warns people browsing the site.
- zenexer 7y ago
  What do you propose they do? Purchasing the .com for well-known software is prohibitively expensive, especially for FOSS projects. You could attempt a UDRP, but that’s also prohibitively expensive. To suggest that inability to do anything—or even indifference, as you characterize your argument in a later comment—implies they’re “in on it” is simply illogical. There’s no evidence of KeePass developers being involved here, and it’s quite unlikely that they are. Short of using their own money—thousands of dollars—to hire a lawyer, there’s not much they can do. Rebranding doesn’t really make sense. People are going to keep searching for and suggesting KeePass for a long time after the rebrand. It’s too established for them to pull that off; they’d end up driving even more people into the hands of malicious actors. When people search for KeePass, being unaware of the rebrand, they’ll inevitably stumble upon nefarious websites purporting to be KeePass. It just amplifies the problem.
- imtringued 7y ago
  Malicious actors buy domain names all the time to pressure organizations or companies into paying thousands of dollars for a domain name like company.sucks. It wouldn't surprise me if malware developers pivoted to blackmailing by damaging good reputations via their malware. A clean $5000 check is better than skimming $10 off of hundreds of credit cards or McDonalds accounts.
cheez 7y ago
Blocked for me by uBlock
- onurtag 7y ago
  Same. After I tried unblocking it temprorarily Firefox blocked it as well.
avip 7y ago
Let this stand as a reminder that paying that extra 17$ for a more legit looking TLD may just be the right thing to do.
- satya71 7y ago
  The legit one is usually squatted upon. It's not extra $12 (typical .com price) but extra $12k+
  - freehunter 7y ago
    That's just a business problem, not any different for domain names than anything else. I have a great idea for a business, it's a small building that sells pizza. Unfortunately I can't name it Pizza Hut because that's already taken. I want to start a supermarket and my last name is Wall, I can't exactly call it Wallmart. I want to start an electronics supply company, I can't call it Tesla. I have to come up with other names. I want to create an app that helps people relax. Sorry, Calm is taken, I need a different name. I want an app that's like a book of faces... Facebook is taken. I need a different name. If someone else already has the domain name you want, you can register under a different tld, but you have to be aware that this conflict will exist and confusion will be a problem.
    - JetSpiegel 7y ago
      I would be good money this is the opposite, the .com was registered afterwards.
- HunOL 7y ago
  Is there any list of TLDs sorted by credibilityy score?
ukyrgf 7y ago
When I used to install Keepass on a new computer, I would Google "keepass" and then hesitate a moment before clicking the .info domain. The best solution I could come up with was to start using KeePassXC instead.
freehunter 7y ago
I have the same issue with Putty. I was helping a client debug an issue with an appliance they bought from my company (me on their computer, them watching over my shoulder) and asked if I could download Putty on their machine. They said yes, so I went to "https://www.chiark.greenend.org.uk/~sgtatham/putty/" https://www.chiark.greenend.org.uk/~sgtatham/putty/" and clicked the download link and they flipped out. It's too fishy, they said, must be a malicious site. I went to putty.org instead (not affiliated with Putty), and clicked the "download putty" link and it redirected back to the other site, and from that point they refused to let me download Putty. We then spent 3 hours getting approvals for me to get my own laptop on their internal network so I could use ssh from my Macbook. I felt bad because my company charges like $300/hr for our consulting services, so we wasted nearly $1000 because the main Putty download site seemed too suspicious for the client to be comfortable with. I know Putty is legitimate and I know it's a free product, but appearances do matter. Presentation does matter. Although I do blame Microsoft a bit for not shipping an SSH client for so long.
- deytempo 7y ago
  You should have downloaded it yourself and sent it to them via an encrypted zip file
- sireat 7y ago
  How about using ninite.com for managing popular Windows downloads? Ninite has decent corporate adoption by now. You could even push them towards Ninite Pro.

hombre_fatal 7y ago

Not owning the .com, letting this happen, and then letting your users get fucked for a year is so incompetent that it's less of a reach to assume the Keepass devs are simply in on it. If you're buying a .info or adding "Origin" after your name, then it's time for a rebrand. You scrape together pennies in your stubbornness at the massive expense of filling the coffers of the bad actors and screwing your users with confusion. Especially for security software.

mysterypie 7y ago
At least a little bit of criticism should go to Google Search as well. Isn't it their mission to show users useful search results? Is there any user that would prefer the fake malware site over the legitimate site? KeePass is a popular piece of software, not an obscure item to search for. And it seems like it's been going on for many months, plenty of time to make Google's algorithms respond (if they wanted to).
- hombre_fatal 7y ago
  One of the incredible perks of getting your phishing/malware site on the .com tld of your target website is the amount of people who will visit your site directly without even going through google. Also, in my experience, Google is very receptive to and decisive on phishing and malware complaints. I've worked on websites that are constant phishing/malware targets and Google moved quickly with us on getting that "this is a malicious website" splash page into Chrome. Since this has been going on for a year, I'd be shocked if the Keepass people even tried. Not even a mention of it on their homepage to help their users pick the legit one?
- satya71 7y ago
  I'm sure being mentioned on HN has now pushed the phishing site higher in Google rankings
- slig 7y ago
  My take: a considerable amount of users see the .com on SERP, and click on it over the .info. Google algorithm then increases the ranking of the .com even more because that's where users go and stay (i.e, they don't bounce back to the search).
feanaro 7y ago
I'm not sure I'm buying into this .com elitism. In the end, it's a TLD like any other and its presence does not guarantee that your trust is warranted, as this very case shows. It cannot replace actual verification and vetting of the sources you're installing software from. An acknowledgement of the situation on the official site would be nice, though.
- hombre_fatal 7y ago
  You don't take phishing/malware or your users seriously enough if you think "tld elitism" is a talking point here. See my sibling post.
  - HunOL 7y ago
    Well, keepass.com was registered in 2005, and keepass.info in 2006.
  - feanaro 7y ago
    Well, it is TLD elitism. Sometimes acquiring a domain is not an option. Sometimes you can lose domains. What then? Nothing can replace common sense and critical thinking when installing software from the internet. In the end, everything on the internet is potentially untrusted and blindly looking for ".com" is just a dumb strategy if your goal is not to get pwned. I really cannot bring myself to consider not acquiring <software_name>.com a failure of the software package creator. As I said, if they are aware of a currently on-going phishing attempt that is masquerading as their own software, a prominent tip on their actual website would be nice. The namespace is finite and not every website can be expected to be under .com. Also, the trustworthiness of a TLD is itself a fad, a fashion that changes over time. See: the popularity of .io.
Datenstrom 7y ago
I agree with feanaro, users should not trust .com over any other tld and if many of them need to touch a hot stove to let this sink in then so be it. Also, I don't think anything that has any cost at all should be expected of any open source project unless you are paying them.
- hombre_fatal 7y ago
  I think that's a very sad and hostile way to treat people not as tech savvy as you. You talk about how users should do their own research, yet nobody at Keepass could even be bothered to update their homepage to help users make the disambiguation. Has Keepass done anything about this over the last year? Keepass' last release was 8 days ago. What even is the point of pushing another commit until you've at least done the bare minimum to help your users? What even is the bedrock purpose of this software at that point? Isn't the goal a password manager to help good folks avoid getting pwned by bad guys in the first place? Yet they now have zero skin in the game when bad guys use their image to pwn their own users? I just see bizarre incongruence. Like working hard to ship releases because that's the dedication your users deserve, gosh darnit, while your website has been compromised and serving different binaries for years.
  - Groxx 7y ago
    >I think that's a very sad and hostile way to treat people not as tech savvy as you. To some degree, agreed. To some degree, this is the way the world works and protecting them earlier increases the risk that they'll make a big mistake later. Potayto, potahto. The underlying system is still so messed up that safety here is literally impossible, and there's no alternative.
  - Datenstrom 7y ago
    I don't mean to be harsh that is just how people learn. It is something false about the world many people believe to be true and people learn from experience. I'm not sure the target audience for Keepass is anyone but tech savvy individuals either, I certainly don't know any non tech people that use it only LastPass and others like it. I touched a hot (wood) stove when I was a kid by the way.
Fnoord 7y ago
> Not owning the .com, letting this happen, and then letting your users get fucked for a year is so incompetent that it's less of a reach to assume the Keepass devs are simply in on it. > If you're buying a .info or adding "Origin" after your name, then it's time for a rebrand. You scrape together pennies in your stubbornness at the massive expense of filling the coffers of the bad actors and screwing your users with confusion. Especially for security software. So, apparently, according to you, not owning the .com equivalent to your non-.com domain means you're incompetent. Has it ever occurred to you that not everyone is from the USA? If you're supposed to own the .com domain anyway then why ever bother with non-.com domains? All non-.com domains are obsolete according to your reasoning, including .net and .org and CCTLDs. Also, this is non-commercial, free as in beer, FOSS. Where was your donation to the project?
- deleted 7y ago
  [deleted]
- hombre_fatal 7y ago
  Just to be clear, you quoted me enumerating a sequence of three things that together informed my judgement, yet you tried to refute my judgement by only responding to one of those things and thus mischaracterized my criticism in that process. Also, I think indifference is a better accusation here than incompetence. If I had to summarize my point of view across the various posts I've made here, it's that I think they are failing all the good folks who made the mistake of looking up Keepass after hearing that it would help them take an important step of cyber security in their life, getting fooled by an imposter, and getting pwned.
  - Fnoord 7y ago
    "They're misquoting me! This is unfair!" Well, that is to keep it brief because there's not much to refute on the other two 'things'... > letting this happen, and then letting your users get fucked for a year Is out of their control. They're not responsible for Keepass.com. That's both simple and obvious. Apparently, if they put up some kind of banner on their website it'd be all cool and dandy? Do you feel the same about uBlock Origin? Let's get this straight. That uBlock Origin warns users that ublock.org is fake is a service. They do not owe you that service. They owe you two things: jack and squat. You sound like you're entitled, but I ask you again: what did you contribute to make the problem go away? Did you donate money to the problem? Did you contact the project?
Mirioron 7y ago
You're free to donate them money so they can do that.
tptacek 7y ago
KeePass is an open source project. There's no "letting" involved: they don't have the domain name. Please be more careful about accusing people of malfeasance. You could have written a good version of this comment that said something like "KeePass should rename, that's in the best interests of its users". Try to write constructively here.
- stingraycharles 7y ago
  I agree. To turn this thread into something more constructive: it might be a good idea to report it to https://safebrowsing.google.com/safebrowsing/report_phish/ https://safebrowsing.google.com/safebrowsing/report_phish/ to make sure it gets Google's attention, and hopefully warns people browsing the site.
zenexer 7y ago
What do you propose they do? Purchasing the .com for well-known software is prohibitively expensive, especially for FOSS projects. You could attempt a UDRP, but that’s also prohibitively expensive. To suggest that inability to do anything—or even indifference, as you characterize your argument in a later comment—implies they’re “in on it” is simply illogical. There’s no evidence of KeePass developers being involved here, and it’s quite unlikely that they are. Short of using their own money—thousands of dollars—to hire a lawyer, there’s not much they can do. Rebranding doesn’t really make sense. People are going to keep searching for and suggesting KeePass for a long time after the rebrand. It’s too established for them to pull that off; they’d end up driving even more people into the hands of malicious actors. When people search for KeePass, being unaware of the rebrand, they’ll inevitably stumble upon nefarious websites purporting to be KeePass. It just amplifies the problem.
imtringued 7y ago
Malicious actors buy domain names all the time to pressure organizations or companies into paying thousands of dollars for a domain name like company.sucks. It wouldn't surprise me if malware developers pivoted to blackmailing by damaging good reputations via their malware. A clean $5000 check is better than skimming $10 off of hundreds of credit cards or McDonalds accounts.

cheez 7y ago

Blocked for me by uBlock

onurtag 7y ago
Same. After I tried unblocking it temprorarily Firefox blocked it as well.

avip 7y ago

Let this stand as a reminder that paying that extra 17$ for a more legit looking TLD may just be the right thing to do.

satya71 7y ago
The legit one is usually squatted upon. It's not extra $12 (typical .com price) but extra $12k+
- freehunter 7y ago
  That's just a business problem, not any different for domain names than anything else. I have a great idea for a business, it's a small building that sells pizza. Unfortunately I can't name it Pizza Hut because that's already taken. I want to start a supermarket and my last name is Wall, I can't exactly call it Wallmart. I want to start an electronics supply company, I can't call it Tesla. I have to come up with other names. I want to create an app that helps people relax. Sorry, Calm is taken, I need a different name. I want an app that's like a book of faces... Facebook is taken. I need a different name. If someone else already has the domain name you want, you can register under a different tld, but you have to be aware that this conflict will exist and confusion will be a problem.
  - JetSpiegel 7y ago
    I would be good money this is the opposite, the .com was registered afterwards.
HunOL 7y ago
Is there any list of TLDs sorted by credibilityy score?

ukyrgf 7y ago

When I used to install Keepass on a new computer, I would Google "keepass" and then hesitate a moment before clicking the .info domain. The best solution I could come up with was to start using KeePassXC instead.

freehunter 7y ago

I have the same issue with Putty. I was helping a client debug an issue with an appliance they bought from my company (me on their computer, them watching over my shoulder) and asked if I could download Putty on their machine. They said yes, so I went to "https://www.chiark.greenend.org.uk/~sgtatham/putty/" https://www.chiark.greenend.org.uk/~sgtatham/putty/" and clicked the download link and they flipped out. It's too fishy, they said, must be a malicious site. I went to putty.org instead (not affiliated with Putty), and clicked the "download putty" link and it redirected back to the other site, and from that point they refused to let me download Putty. We then spent 3 hours getting approvals for me to get my own laptop on their internal network so I could use ssh from my Macbook. I felt bad because my company charges like $300/hr for our consulting services, so we wasted nearly $1000 because the main Putty download site seemed too suspicious for the client to be comfortable with. I know Putty is legitimate and I know it's a free product, but appearances do matter. Presentation does matter. Although I do blame Microsoft a bit for not shipping an SSH client for so long.

deytempo 7y ago
You should have downloaded it yourself and sent it to them via an encrypted zip file
sireat 7y ago
How about using ninite.com for managing popular Windows downloads? Ninite has decent corporate adoption by now. You could even push them towards Ninite Pro.