3 ms·
I’ve been looking for something like this for awhile but not enough of a security expert to know if this is something I can trust
by rudolph9 7y ago
I’ve been looking for something like this for awhile but not enough of a security expert to know if this is something I can trust
- bscphil 7y agoNot an expert, but I think I'm decently knowledgeable. The design as outlined in the security section of the readme looks just fine to me, assuming the key is securely derived from the password. I would hope for more emphasis on the importance of choosing a secure master password. Ideally you should be able to treat its hash (which is prepended to the database) as public knowledge, even if in practice you'll keep the database as private as you can. That said, barring an audit by a respectable security firm, I think a lot of eyeballs on an open source project who can confirm that the implementation is correct is the most important thing. For that reason, I don't plan to switch away from Keypass in the near future.
- DEADBEEFC0FFEE 7y agoMany eyes, and/or audit is essential, for many I would think.
- xerxesaa 7y agoAre you familiar with Bitwarden and KeePassXC? If so, I"m curious why neither of those meet your use case.