4 ms·

My password manager locks when I lock my screen. You can configure it to lock after some time. The database is encrypted at rest.

necovek 2y ago
Locking is not sufficient: it would need to overwrite the memory where passwords were decrypted to. With virtual memory, this becomes harder.
- compootr 2y ago
  What's sufficient depends on your threat model. Normal dude in a secure office? An auto-locking password manager would suffice. Someone that should be concerned with passwords in-memory is someone who believes another has full physical access to their computer (and can, say, freeze RAM in nitrogen to extract passwords My largest concern would be an adversary snatching my phone while my password manager was actively opened
  - necovek 2y ago
    Locking a password manager and your computer is certainly good enough in many cases. But gaining access to memory might not need the sophistication of using nitrogen (see eg https://en.m.wikipedia.org/wiki/DMA_attack https://en.m.wikipedia.org/wiki/DMA_attack).
- freeone3000 2y ago
  But still not particularly hard. mmap has a MMAP_FIXED flag for this particular reason — overwrite the arena you’re decrypting to, and you should be set.
- supertrope 2y ago
  https://keepass.info/help/base/security.html#secmemprot https://keepass.info/help/base/security.html#secmemprot
  - necovek 2y ago
    > On Unix-like systems, KeePass 2.x uses ChaCha20, because Mono does not provide any effective memory protection method. So only Windows seems to use secure memory protection.
    - supertrope 2y ago
      https://keepassxc.org/blog/2019-02-21-memory-security/ https://keepassxc.org/blog/2019-02-21-memory-security/
      - necovek 2y ago
        Ok, we seem to be moving the goalposts a bit. My point is that you need to read up on it to ensure the implementation of memory handling for your password manager is really safe. As you demonstrate yourself, KeePass has different clients with different memory protection profiles which also depends on the system.
- borski 2y ago
  https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...

necovek 2y ago

Locking is not sufficient: it would need to overwrite the memory where passwords were decrypted to. With virtual memory, this becomes harder.

compootr 2y ago
What's sufficient depends on your threat model. Normal dude in a secure office? An auto-locking password manager would suffice. Someone that should be concerned with passwords in-memory is someone who believes another has full physical access to their computer (and can, say, freeze RAM in nitrogen to extract passwords My largest concern would be an adversary snatching my phone while my password manager was actively opened
- necovek 2y ago
  Locking a password manager and your computer is certainly good enough in many cases. But gaining access to memory might not need the sophistication of using nitrogen (see eg https://en.m.wikipedia.org/wiki/DMA_attack https://en.m.wikipedia.org/wiki/DMA_attack).
freeone3000 2y ago
But still not particularly hard. mmap has a MMAP_FIXED flag for this particular reason — overwrite the arena you’re decrypting to, and you should be set.
supertrope 2y ago
https://keepass.info/help/base/security.html#secmemprot https://keepass.info/help/base/security.html#secmemprot
- necovek 2y ago
  > On Unix-like systems, KeePass 2.x uses ChaCha20, because Mono does not provide any effective memory protection method. So only Windows seems to use secure memory protection.
  - supertrope 2y ago
    https://keepassxc.org/blog/2019-02-21-memory-security/ https://keepassxc.org/blog/2019-02-21-memory-security/
    - necovek 2y ago
      Ok, we seem to be moving the goalposts a bit. My point is that you need to read up on it to ensure the implementation of memory handling for your password manager is really safe. As you demonstrate yourself, KeePass has different clients with different memory protection profiles which also depends on the system.
borski 2y ago
https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...