Re:KeePassXC 2.2.0 released with YubiKey and TOTP support
by sillysaurus3 on Monday June 26, 2017 @11:47AM
(#14637676)
Well, yes, that's the goal. But it's surprisingly easy to mess up. I think the people here are cautioning you not to get overconfident, and to make sure you research the details of the flaws in other systems.
Re:KeePassXC 2.2.0 released with YubiKey and TOTP support
by varjolintu on Monday June 26, 2017 @12:24PM
(#14637967)
It is easy to mess up, yes. I'm not overconfident, but almost the opposite. Without being totally paranoid, I'm usually pretty certain something important is forgotten. All help is welcome :)
Re:KeePassXC 2.2.0 released with YubiKey and TOTP support
by gaia on Monday June 26, 2017 @12:29PM
(#14638007)
chromeIPass' possible vulnerabilities being?
Re:KeePassXC 2.2.0 released with YubiKey and TOTP support
by varjolintu on Monday June 26, 2017 @01:05PM
(#14638370)
KeePassXC restricts chromeIPass to localhost, so data should be safe. Still, chromeIPass exchanges encryption keys in base64. Basically that's plain text. These are the only keys used, so technically it's possible to steal those keys (if not localhost). But if someone has permission to read your loopback or local packet traffic, your info is gone..
Other than that, chromeIPass uses quite old libraries and depricated API functions. Those haven't been updated in ages. keepassxc-browser should fix all issues mentioned above :)
Re:KeePassXC 2.2.0 released with YubiKey and TOTP support
by varjolintu on Tuesday June 27, 2017 @02:18AM
(#14642912)
Also, any autofilling is disabled by default.
I have been keeping eye on the vulnerabilities and going to be very careful when it is time for a final release. Currently if there's any vulnerabilities, these are almost identical to chromeIPass' possible vulnerabilities.