2 ms·

I use KeePass + dropbox. Works on windows and android. I'm pretty sure you don't need to trust the syncing software, so anything should work. Someone please c

• rocqua 5y ago
  Syncing software could perhaps do so cyphertext malleability attacks. Changing the ciphertext, and deducing information on the plaintext based on client behavior. Perhaps they could force you into a password reset for a specific site by corrupting the correct files. That might be an interesting first step for an account takeover. These are highly complicated, active attacks. I wouldn't worry as long as your sync service isn't literally the Russian or Chinese government.
  • jfrunyon 5y ago
    > Perhaps they could force you into a password reset for a specific site by corrupting the correct files. That might be an interesting first step for an account takeover. It would be interesting to see that accomplished without making it obvious (particularly: without corrupting large parts of or the entire database). KeePass encrypts the whole database.