Being privacy-aware in 2016

Re:Being privacy-aware in 2016 by tombrossman on Monday June 06, 2016 @08:23AM (#11846221)

Curious, who is "compiling KeePassX for Linux themselves" when it's in the Ubuntu and Debian repos? I haven't checked Arch or other distros but KeePassX is a widely used and active project, and I suspect it is available in many package managers. I wasn't aware that people were having to compile it from source (and I agree this would be more intimidating to new users).

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by nikcub on Monday June 06, 2016 @08:34AM (#11846268)

> Curious, who is "compiling KeePassX for Linux themselves" when it's in the Ubuntu and Debian repos?

It's in the OP:

"I highly recommend using KeepassX as a password manager, secured using a key file and not a password. Also, you should download the source code, compile it (using a Linux machine) and always look over the source code for rogue functions, you CANNOT afford a vulnerability inside the password manager."

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by tombrossman on Monday June 06, 2016 @09:40AM (#11846656)

Thanks, I saw that but was hoping people would not actually bother - that's deep into 'tinfoil-hat' territory. If you are already running a Linux distro and trusting the repos for OS updates, it isn't a big stretch to assume their build of the password manager is exactly as safe as the OS updates, and trusting one but not the other is pure folly.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by slavik81 on Monday June 06, 2016 @12:25PM (#11847958)

KeypassX 2.0 was in alpha for years (though I never noticed a bug). I don't think it was available in distribution packages until quite recently.

That being said, I'm decent with C++, and yet auditing its code is a little daunting.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by wallace_f on Monday June 06, 2016 @11:30AM (#11847495)

This is also exactly my intuition here, but I'm hoping for others to comment here as well.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by elcapitan on Monday June 06, 2016 @05:49PM (#11850697)

> always look over the source code for rogue functions

I don't really understand the reasoning behind that - so rather than trusting a proven OS and its packages with lots of eyes on the critical code, I should rather read the code of a cryptographic product and then make a decision based on that? Common advice is not to write crypto code yourself, but reading it and deciding that there might be a backdoor based on gut feeling is right? And having identified some stuff I don't understand, then decide for another program that is goofy but easier to read, and compromise security?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by maglavaitss on Monday June 06, 2016 @05:51PM (#11850712)

It's more about looking over the source code of the KeepassX app and just that (not all applications you use, of course we have to trust some of them), the code changes are (when there are changes) ~10 lines a month, not a huge amount to check.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by elcapitan on Monday June 06, 2016 @05:59PM (#11850771)

What about all its dependencies? What if someone made some unsuspicious changes in a UI library that it uses that have a side effect on the security of KeepassX?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by maglavaitss on Monday June 06, 2016 @06:02PM (#11850799)

https://github.com/keepassx/keepassx If libgcrypt, QT, zlib get compromised I guess it's game over, but it's a long way to go, it will get noticed.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by elcapitan on Monday June 06, 2016 @06:09PM (#11850850)

But that's the same argument that I was making about KeepassX itself before. So if I'm trusting for the dependencies to get watched well for not being compromised, why then look into KeepassX itself, wouldn't that apply for the app itself as well?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by maglavaitss on Monday June 06, 2016 @06:12PM (#11850866)

Because KeepassX is way less used (and its source code checked) than ... QT for example, so rogue functions added into KeepassX will be have less visibility than one added into zlib.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by elcapitan on Monday June 06, 2016 @06:35PM (#11851021)

Ok, fair enough. Sorry, didn't mean to troll, was just curious. Still sounds like bad advice for the majority of users who can't really make that call, but for those who can it's consistent.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by maglavaitss on Monday June 06, 2016 @06:37PM (#11851030)

Don't worry about it :) Not all the steps are mandatory and not all are suited for the majority of Internet users. Everybody picks a base and starts from there.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by elcapitan on Monday June 06, 2016 @06:43PM (#11851080)

When it comes to security, I usually worry about people creating complexity that scares people away, and therefore weaken the overall security of all. Over-complex and annoying password procedures are one everyday example that force many people to just go for some stupid password that follows the rules but is easy to crack.

So if there are rules to improve the privacy of users, I would worry about making it look to complex or extreme. I suspect rather than picking some parts that work for them they will go "ok this i can do, this I can do, and .. wait compile it myself and read the source?! - ok, I'll stick to post it notes".

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by fauigerzigerk on Monday June 06, 2016 @11:25AM (#11847443)

Why is it a good idea to use a key file instead of a password? Any malware I catch could use the key file to access all my passwords or is there something I'm not understanding?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by ahartman00 on Monday June 06, 2016 @04:47PM (#11850212)

I'd recommend both, keepass supports that. Keepass supports using a secure desktop to prevent keyloggers[1], but you never know with some of the usb keyboard exploits[2], and good old fashioned looking over your shoulder. While keepass has protection against dictionary attacks[3], why not use a keyfile? you can put it on a flash drive, and now noone can access your passwords without that usb key. (obviously make sure you have multiple copies of your keyfile :)

1. http://keepass.info/help/base/security.html#secdesktop 2. http://arstechnica.com/security/2014/07/this-thumbdrive-hack... 3. http://keepass.info/help/base/security.html#secdictprotect

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by fauigerzigerk on Tuesday June 07, 2016 @03:53AM (#11853034)

>why not use a keyfile?

Because you're always just one burglary away from passwordocalypse?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by giancarlostoro on Monday June 06, 2016 @02:05PM (#11848856)

I would personally use a combination of both. If you keep the key file on a USB thumb drive that you only insert when you need to unlock your files I guess it works out well then.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by fauigerzigerk on Monday June 06, 2016 @03:00PM (#11849348)

That sounds like a better idea, but I still don't really see the upside as compared to remembering one long passphrase.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by jwives on Monday June 06, 2016 @05:25PM (#11850537)

I use a combination of password and key file so that I can worry less about someone shoulder surfing or otherwise observing the input of my password.

My password database is stored on a USB key that I carry with me, with a regular copy made and securely stored.

Key file is stored on devices I use, in a directory restricted to my own access and on a drive which is encrypted. An encrypted copy is also stored on the USB key with the password database; this can be decrypted using a GPG, key stored on a yubikey and also carried; if a device can be trusted enough, this is how I move the key file around.

Access to the database requires 3 things rather than two. A long passphrase could be recorded by an observer, who could then take my USB key. The key file ensures that they still do not have all that they need.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by giancarlostoro on Tuesday June 07, 2016 @07:19PM (#11858829)

The idea is, if the <attacker> doesn't have the key file, it doesn't matter what password they try, they wont get in.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by maglavaitss on Monday June 06, 2016 @05:53PM (#11850724)

Only got in the Ubuntu repos lately and not everybody uses Debian and derivatives.

[ Parent | on HN ]