News for hackers. Stuff that matters.

A comment on Non-official site with a tampered version of KeePass. Parent comment

Re:Non-official site with a tampered version of KeePass by mihaifm on Friday July 27, 2018 @07:06AM (#17625047)
I agree, that's why signed source code releases are the safest thing you can get. Keepass has signed releases (including the source code archive) that can be checked with OpenPGP.

https://keepass.info/integrity.html

[ Parent | on HN ]
Re:Non-official site with a tampered version of KeePass by svenfaw on Friday July 27, 2018 @07:35AM (#17625181)
If you trust the signed source code there's no reason you shouldn't trust the signed binary - unless you have sufficient time and expertise to audit the source.
[ Parent | on HN ]
Re:Non-official site with a tampered version of KeePass by mihaifm on Friday July 27, 2018 @07:55AM (#17625287)
This is how I view it:

* Being open source protects against a malicious developer. Otherwise there is nothing preventing him to build the binary with a different source, and send the passwords to his own server.

* Signed code archive prevents against a compromised hosting site.

[ Parent | on HN ]
Re:Non-official site with a tampered version of KeePass by perl4ever on Saturday July 28, 2018 @01:31AM (#17631712)
In order to get from a trusted source to a trusted binary, you have to trust the compiler and its dependencies as well, I think.
[ Parent | on HN ]