News for hackers. Stuff that matters.

A comment on KeePassXC 2.2.0 released with YubiKey and TOTP support. Parent comment

Re:KeePassXC 2.2.0 released with YubiKey and TOTP support by jsfitzsimmons on Monday June 26, 2017 @12:36PM (#14638075)
Your second point is a great point, and I believe that there should be a user prompt every time something tries to read from the password database over any API.

With that said, what's the threat model for the first point? Is localhost interception a serious risk?

[ Parent | on HN ]
Re:KeePassXC 2.2.0 released with YubiKey and TOTP support by Quiark on Tuesday June 27, 2017 @12:04PM (#14646639)
As far as I know, localhost can't be intercepted. Except for unintentional mistakes such as binding to 0.0.0.0 instead of 127.0.0.1. And inevitably there are going to be some tinkerers who'll run it over the network because it suits them.
[ Parent | on HN ]