TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

KeePass disputes vulnerability allowing stealthy password theft

28 点作者 archb超过 2 年前

2 条评论

parasense超过 2 年前
I actually agree with the KeePass devs.<p>There are two levels of local compromise, root compromise, and user level compromise. Both are really bad for the user, but if the root access was cracked then we can assume there is a key-logger at the dev&#x2F;tty level tracking all keystrokes. If it&#x27;s the user-level then we can assume all home dir files are exploited. There are shades of grey here, because if the user runs a flatpak the app cannot be replaced so easy, but config files can be changed.<p>I would imagine the database file could be setup to bundle the config file, or even take a hash of the config file to be kept encrypted. But still, it would not be too much of a stretch to presume any version of the program could be run under a debugger to capture input, regardless of config files.
briHass超过 2 年前
I&#x27;d recommend going (and I do) one step further: lock down the KP config file, and especially the keyfile (definitely use this in addition to a password), to admins only and set the .exe to launch as administrator. The .exe is signed, so at least you have some guarantee it hasn&#x27;t been modified. Plus, the UAC prompt doesn&#x27;t look scary like it does for unsigned exes. The password DB (kdbx) can have standard access permissions so it works with whatever sync&#x2F;backup (Google Drive, Dropbox, etc) you want to use. It&#x27;s worthless without the keyfile.<p>Executables running as administrator have all sorts of protections from other processes in user-land, and most importantly, the keyfile (locked to R&#x2F;W only by admin) can&#x27;t be Xcopy exfiltrated by a bog-standard malware process accidentally launched by clicking the wrong thing.<p>It never made sense to me why this isn&#x27;t a common recommendation. To me, my password DB, and especially the keyfile and&#x2F;or the process that decrypts the secrets in memory, are the most important things on my device. Those belong at the highest level of security an OS can offer, not running at the same level as some crap I downloaded from the internet.<p>I know KeePass also offers Windows DPAPI as an additional option (encryption at the user level.) It&#x27;s been a while since I&#x27;ve dug into DPAPI, but that may offer additional advantages as long as Windows doesn&#x27;t allow the RSA private key for a user to be extracted running as that user. That, of course, has the significant disadvantage of not being portable, and you better backup that RSA key.