6 ms·

KeePassXC 2.6.4 Released

86 points by varjolintu 6y ago

pottedplant 6y ago
Does anyone here feel more confident about a security software when it has a team page with real humans behind it? That was one of the things that always made me uncomfortable about TrueCrypt for example. Sure there is code. But I can't go through the code..
- gen3 6y ago
  I’ve been fine with KeePassXC, mainly because the file format is just AES encrypted xml. Sure, they could have still done something nonstandard and potentially dangerous, but with all the other clients people make I would expect that to get exposed reasonably quick.
  - arsome 6y ago
    "Just AES encrypted" is a pretty limited way of looking at things. AES offers plenty of ways to screw things up, off the top of my head with my limited cryptographic knowledge: how do you do random number generation? How do you deal with password-based key derivation? Is it resistant to GPU bruteforcing? Did you pick a good mode of operation for the use case and are you properly managing IVs? Do you authenticate encrypted data? As far as I'm aware the newest KeePass format seems to do these things well (they switched from a custom AES-based KDF to using Argon2 recently), but I'm not sure if KeePass XC does the same and I'm certainly not qualified to review these things perfectly myself.
    - zaarn 6y ago
      KeepassXC has availability of Argon2id and Argon2. It's very decent software IMO that improves over standard Keepass.
- Phenix88be 6y ago
  There is real humans behind every software, I don't understand the logic here.
  - NullPrefix 6y ago
    >Original release of TrueCrypt was made by anonymous developers called "the TrueCrypt Team".
  - bitxbitxbitcoin 6y ago
    Replace "humans" with "human reputations."
- t0astbread 6y ago
  I don't agree with you but the developers disclose their real names in the about dialog in KeePassXC.
- bitxbitxbitcoin 6y ago
  I do understand the sentiment but I can imagine that depending on who the real humans behind TrueCrypt were, their presence on a team page could have just as easily decreased confidence.
- brnt 6y ago
  Actually, I do, with any software. I'm aware you may as well use it to fool me with some stock profiles, but seeing the humans behind the code increases my comfort of using it. You wouldn't show your face if you're 'selling' me crap, would you?
  - t0astbread 6y ago
    There are a lot of people who show you their face (or a face) to gain trust and sell you crap. Inversely, there's also a lot of people producing really good software who wouldn't wanna show you their face. Also, I'm not accusing you of anything but I have the feeling real name/face/whatever policies are one of those things that disproportionately affect minorities (people who are subject to harassment online or otherwise uncomfortable sharing their identity) while doing almost nothing to ensure trustworthiness.
- avhon1 6y ago
  I'm not sure this is a good signal for trustworthiness. For example, how do you know the humans are real? In this new age of deepfakes, it's easier than ever to generate profiles of non-existent people.
- nyolfen 6y ago
  irl identities are attack surfaces
boromi 6y ago
I wish they could integrate Windows Hello into it. It's the only thing holding me back from KeePass.
- phoerious 6y ago
  Then it may excite you to see this: https://github.com/keepassxreboot/keepassxc/pull/6029 https://github.com/keepassxreboot/keepassxc/pull/6029
  - boromi 6y ago
    wow, I did not expect them to do this after reading issues that they couldn't work with the Windows API for some reason since it didin't have a C++ API.
    - tuankiet65 6y ago
      You can use WRL or C++/WinRT (current recommended way) to access the WinRT API from C++.
      - phoerious 6y ago
        The problem isn't so much the language as the fact that it's very tedious if you only have access to the old Win32 API as a result of toolchain constraints. It is much easier with the VCpp toolchain.
- mynameisash 6y ago
  I love KeePass (proper; I don't use XC), but it would be nice if they had better support for hardware keys[0]. What I want is to keep my existing password and add in the hardware support -- just plug in the key, press the button, and be done with it. [0] https://keepass.info/help/kb/yubikey.html https://keepass.info/help/kb/yubikey.html
  - fidelramos 6y ago
    It's not exactly what you are asking for, but KeepassXC supports OnlyKey [0], and OnlyKeys can enter a password just pressing a button, plus they have HMAC support, so the KeepassXC experience can be: 1. Plug in Onlykey and unlock if necessary. 2. Open database in KeepassXC. 3. Press button in Onlykey with the KeepassXC password. 4. Press any button again when it asks for HMAC challenge. [0] https://onlykey.io/ https://onlykey.io/
dinkblam 6y ago
the update is already available for updating via #MacUpdater
whatsmyusername 6y ago
How many letters are we going to get behind KeePass? I use KeePassX and have for years. Having 14 forks seems... odd to me. Yeah consumer choice but I'd rather one or two tested solid products than 14 flavors of the month.
dogline 6y ago
What's the difference between KeePassXC and KeePass? They both seem to be recently updated. Currently using BitWarden and I like the sync, the browser integration, and availability on Android.
- vbezhenar 6y ago
  Keepass is made with .NET. It’s native for Windows. It works with other OS using Mono, but it’s not as native, I guess. KeepassXC written with C++ and crossplatform GUI, so it’s better fit with Linux and macOS. Also, AFAIK, KeepassXC has more features. I’m using Keepass because I trust C# more than I trust C++ when it comes to security. But it’s nice to have options.
- jasode 6y ago
  The website page of this release also has a FAQ that answers your question: https://keepassxc.org/docs/#faq-keepassx https://keepassxc.org/docs/#faq-keepassx tldr is : C# (canonical project) -- vs -- C++ (older project) -- vs -- C++ (newer project)
- fisian 6y ago
  KeePass uses .Net/mono to run on all platforms, while KeePassXC has a more "native" feel. KeePass has many plugins available, which allow extending its behavior. KeePassXC doesn't have plugins, but has many quality of live things built-in. I used both, but currently use KeePassXC. I really love its ssh key integration.
- stuckindider 6y ago
  Keepass's website uses http because switching to https may hurt advertising revenue.
  - mywittyname 6y ago
    https://keepass.info/ https://keepass.info/ Looks like it uses HTTPS to me. What you're referring to is an old (fixed roughly six years ago), and highly misrepresented situation discussed here: https://keepass.info/help/kb/sec_issues.html#updsig https://keepass.info/help/kb/sec_issues.html#updsig
17a9f4a4f4e5b3f 6y ago
I'm a big fan of KeePassXC. One thing I'd like to see is one file being able to be unlocked via multiple keys so for example my desktop could use a password+keyfile whereas my laptop would need password+hardware key, but they both backup to the same file. Do any other managers enable this?
- Groxx 6y ago
  Hmm... you could probably construct this yourself. Make a new database for the new auth method, then set it up to automatically open the 'core' database (which essentially just saves the decryption key in the new database): https://keepassxc.org/docs/KeePassXC_UserGuide.html#_automatic_database_opening https://keepassxc.org/docs/KeePassXC_UserGuide.html#_automat...
  - 17a9f4a4f4e5b3f 6y ago
    Wow! Didn't know that was a feature, neat idea thanks!
kenniskrag 6y ago
the merge two kdbx files is not fixed. It shows a "merged" notification but on the shell I see a merge conflict nothing changed error. :(
finchisko 6y ago
I use keepassxc on windows and linux machines, but on macos I prefer macpass which uses same kdbx format but has ui that feels home on macos

86 points by varjolintu 6y ago

Does anyone here feel more confident about a security software when it has a team page with real humans behind it? That was one of the things that always made me uncomfortable about TrueCrypt for example. Sure there is code. But I can't go through the code..

gen3 6y ago
I’ve been fine with KeePassXC, mainly because the file format is just AES encrypted xml. Sure, they could have still done something nonstandard and potentially dangerous, but with all the other clients people make I would expect that to get exposed reasonably quick.
- arsome 6y ago
  "Just AES encrypted" is a pretty limited way of looking at things. AES offers plenty of ways to screw things up, off the top of my head with my limited cryptographic knowledge: how do you do random number generation? How do you deal with password-based key derivation? Is it resistant to GPU bruteforcing? Did you pick a good mode of operation for the use case and are you properly managing IVs? Do you authenticate encrypted data? As far as I'm aware the newest KeePass format seems to do these things well (they switched from a custom AES-based KDF to using Argon2 recently), but I'm not sure if KeePass XC does the same and I'm certainly not qualified to review these things perfectly myself.
  - zaarn 6y ago
    KeepassXC has availability of Argon2id and Argon2. It's very decent software IMO that improves over standard Keepass.
Phenix88be 6y ago
There is real humans behind every software, I don't understand the logic here.
- NullPrefix 6y ago
  >Original release of TrueCrypt was made by anonymous developers called "the TrueCrypt Team".
- bitxbitxbitcoin 6y ago
  Replace "humans" with "human reputations."
t0astbread 6y ago
I don't agree with you but the developers disclose their real names in the about dialog in KeePassXC.
bitxbitxbitcoin 6y ago
I do understand the sentiment but I can imagine that depending on who the real humans behind TrueCrypt were, their presence on a team page could have just as easily decreased confidence.
brnt 6y ago
Actually, I do, with any software. I'm aware you may as well use it to fool me with some stock profiles, but seeing the humans behind the code increases my comfort of using it. You wouldn't show your face if you're 'selling' me crap, would you?
- t0astbread 6y ago
  There are a lot of people who show you their face (or a face) to gain trust and sell you crap. Inversely, there's also a lot of people producing really good software who wouldn't wanna show you their face. Also, I'm not accusing you of anything but I have the feeling real name/face/whatever policies are one of those things that disproportionately affect minorities (people who are subject to harassment online or otherwise uncomfortable sharing their identity) while doing almost nothing to ensure trustworthiness.
avhon1 6y ago
I'm not sure this is a good signal for trustworthiness. For example, how do you know the humans are real? In this new age of deepfakes, it's easier than ever to generate profiles of non-existent people.
nyolfen 6y ago
irl identities are attack surfaces

boromi 6y ago

I wish they could integrate Windows Hello into it. It's the only thing holding me back from KeePass.

phoerious 6y ago
Then it may excite you to see this: https://github.com/keepassxreboot/keepassxc/pull/6029 https://github.com/keepassxreboot/keepassxc/pull/6029
- boromi 6y ago
  wow, I did not expect them to do this after reading issues that they couldn't work with the Windows API for some reason since it didin't have a C++ API.
  - tuankiet65 6y ago
    You can use WRL or C++/WinRT (current recommended way) to access the WinRT API from C++.
    - phoerious 6y ago
      The problem isn't so much the language as the fact that it's very tedious if you only have access to the old Win32 API as a result of toolchain constraints. It is much easier with the VCpp toolchain.
mynameisash 6y ago
I love KeePass (proper; I don't use XC), but it would be nice if they had better support for hardware keys[0]. What I want is to keep my existing password and add in the hardware support -- just plug in the key, press the button, and be done with it. [0] https://keepass.info/help/kb/yubikey.html https://keepass.info/help/kb/yubikey.html
- fidelramos 6y ago
  It's not exactly what you are asking for, but KeepassXC supports OnlyKey [0], and OnlyKeys can enter a password just pressing a button, plus they have HMAC support, so the KeepassXC experience can be: 1. Plug in Onlykey and unlock if necessary. 2. Open database in KeepassXC. 3. Press button in Onlykey with the KeepassXC password. 4. Press any button again when it asks for HMAC challenge. [0] https://onlykey.io/ https://onlykey.io/

dinkblam 6y ago

the update is already available for updating via #MacUpdater

whatsmyusername 6y ago

How many letters are we going to get behind KeePass? I use KeePassX and have for years. Having 14 forks seems... odd to me. Yeah consumer choice but I'd rather one or two tested solid products than 14 flavors of the month.

dogline 6y ago

What's the difference between KeePassXC and KeePass? They both seem to be recently updated. Currently using BitWarden and I like the sync, the browser integration, and availability on Android.

vbezhenar 6y ago
Keepass is made with .NET. It’s native for Windows. It works with other OS using Mono, but it’s not as native, I guess. KeepassXC written with C++ and crossplatform GUI, so it’s better fit with Linux and macOS. Also, AFAIK, KeepassXC has more features. I’m using Keepass because I trust C# more than I trust C++ when it comes to security. But it’s nice to have options.
jasode 6y ago
The website page of this release also has a FAQ that answers your question: https://keepassxc.org/docs/#faq-keepassx https://keepassxc.org/docs/#faq-keepassx tldr is : C# (canonical project) -- vs -- C++ (older project) -- vs -- C++ (newer project)
fisian 6y ago
KeePass uses .Net/mono to run on all platforms, while KeePassXC has a more "native" feel. KeePass has many plugins available, which allow extending its behavior. KeePassXC doesn't have plugins, but has many quality of live things built-in. I used both, but currently use KeePassXC. I really love its ssh key integration.
stuckindider 6y ago
Keepass's website uses http because switching to https may hurt advertising revenue.
- mywittyname 6y ago
  https://keepass.info/ https://keepass.info/ Looks like it uses HTTPS to me. What you're referring to is an old (fixed roughly six years ago), and highly misrepresented situation discussed here: https://keepass.info/help/kb/sec_issues.html#updsig https://keepass.info/help/kb/sec_issues.html#updsig

17a9f4a4f4e5b3f 6y ago

I'm a big fan of KeePassXC. One thing I'd like to see is one file being able to be unlocked via multiple keys so for example my desktop could use a password+keyfile whereas my laptop would need password+hardware key, but they both backup to the same file. Do any other managers enable this?

Groxx 6y ago
Hmm... you could probably construct this yourself. Make a new database for the new auth method, then set it up to automatically open the 'core' database (which essentially just saves the decryption key in the new database): https://keepassxc.org/docs/KeePassXC_UserGuide.html#_automatic_database_opening https://keepassxc.org/docs/KeePassXC_UserGuide.html#_automat...
- 17a9f4a4f4e5b3f 6y ago
  Wow! Didn't know that was a feature, neat idea thanks!

kenniskrag 6y ago

the merge two kdbx files is not fixed. It shows a "merged" notification but on the shell I see a merge conflict nothing changed error. :(

finchisko 6y ago

I use keepassxc on windows and linux machines, but on macos I prefer macpass which uses same kdbx format but has ui that feels home on macos