News for hackers. Stuff that matters.

A comment on KeePassXC 2.6.4 Released.

Re:KeePassXC 2.6.4 Released by dogline on Monday February 01, 2021 @01:58PM (#25992091)
What's the difference between KeePassXC and KeePass? They both seem to be recently updated.

Currently using BitWarden and I like the sync, the browser integration, and availability on Android.

[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by fisian on Monday February 01, 2021 @02:10PM (#25992281)
KeePass uses .Net/mono to run on all platforms, while KeePassXC has a more "native" feel.

KeePass has many plugins available, which allow extending its behavior. KeePassXC doesn't have plugins, but has many quality of live things built-in.

I used both, but currently use KeePassXC. I really love its ssh key integration.

[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by vbezhenar on Monday February 01, 2021 @02:05PM (#25992214)
Keepass is made with .NET. It’s native for Windows. It works with other OS using Mono, but it’s not as native, I guess.

KeepassXC written with C++ and crossplatform GUI, so it’s better fit with Linux and macOS. Also, AFAIK, KeepassXC has more features.

I’m using Keepass because I trust C# more than I trust C++ when it comes to security. But it’s nice to have options.

[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by jasode on Monday February 01, 2021 @02:09PM (#25992265)
The website page of this release also has a FAQ that answers your question:

https://keepassxc.org/docs/#faq-keepassx

tldr is : C# (canonical project) -- vs -- C++ (older project) -- vs -- C++ (newer project)

[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by stuckindider on Monday February 01, 2021 @02:53PM (#25992873)
Keepass's website uses http because switching to https may hurt advertising revenue.
[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by mywittyname on Monday February 01, 2021 @03:06PM (#25993065)
https://keepass.info/

Looks like it uses HTTPS to me.

What you're referring to is an old (fixed roughly six years ago), and highly misrepresented situation discussed here:

https://keepass.info/help/kb/sec_issues.html#updsig

[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by stuckindider on Monday February 01, 2021 @04:41PM (#25994382)
What you linked isn't talking about the entire site. It literally says that the signature page is secure. But they don't mention the entire site being secure. I wonder why...

Here it is 3.5 years ago being hosted over http and not redirecting to https. It looks like they changed in 2018.

https://web.archive.org/web/20170907194943/http://keepass.in...

[ Parent | on HN ]
Re:KeePassXC 2.6.4 Released by mywittyname on Tuesday February 02, 2021 @12:18AM (#25997672)
The "security issue" you're talking about was that the URL used to determine if there is a new version available was HTTP-only. People felt like this was a security concern because it was susceptible to a MitM attack. The author felt like this was a none-issue because Keepass did not self-update at all, the URL was only used to inform the user of a new version. So a successful MitM attack would merely inform the user of a new version.

New version of the software were served via mirrors and digital signatures for all versions were made available. Standard security practice for the era was to verify the digital signatures of software before installing it because so much software was served by third parties.

Also, this all happened before HTTPS was ubiquitous (the patch to force version checks to use HTTPS came in 2016). Most sites still served traffic over regular HTTP, with only logins and purchase pages using encryption.

[ Parent | on HN ]