[HN Gopher] An exploit can reveal your KeePass master password i...
       ___________________________________________________________________
        
       An exploit can reveal your KeePass master password in plaintext
        
       Author : el_hacker
       Score  : 26 points
       Date   : 2023-05-20 20:24 UTC (2 hours ago)
        
 (HTM) web link (www.pcworld.com)
 (TXT) w3m dump (www.pcworld.com)
        
       | icecap12 wrote:
       | First significant vuln for KeePass in awhile. Still a better
       | threat model than cloud.
        
       | el_hacker wrote:
       | My password is a combination of creating a complex password and
       | forgetting it + the 'Forgot password' button, Is anyone on the
       | same ship?
        
         | waboremo wrote:
         | Congratulations you're using Magic Links.
        
       | opan wrote:
       | >KeePassXC... which are other password managers compatible with
       | KeePass database files, are not affected according to vdohney.
       | 
       | Great.
        
         | psychphysic wrote:
         | Although KeePassXC offers better process memory protection, it
         | also can not help if you hibernate and the memory is written to
         | disk.
         | 
         | Hardware password managers exist and are not so inconvenient.
        
           | mook wrote:
           | Isn't it usually set to re-lock on screen lock (which
           | typically happens before hibernate)?
        
         | dotancohen wrote:
         | Yes, that's the one I use anyway. Great integration with most
         | Linux desktops - a keyboard shortcut brings the target window
         | to the top and enters the username and password right into the
         | proper fields.
        
       | ajuc wrote:
       | I think it's time to change the 90s-inspired security
       | recommendations.
       | 
       | I work from home. I feel much safer with my password written on a
       | piece of paper than with a password manager. God forbid the
       | password manager is cloud-enabled.
        
         | TylerE wrote:
         | That doesn't solve the problem of having 40 different
         | passwords, at least half of which have to be changed on a
         | regular basis, NIST guidelines be damned.
        
         | alwaysbeconsing wrote:
         | This is definitely reasonable if you like to use readable and
         | easily-typed passwords (like Diceware/"correct horse battery
         | staple"-style). A software password manager has an advantage
         | for long, completely random, absolute gibberish passwords,
         | because you don't even have to know what it is: you can just
         | copy-paste or autofill it.
        
           | ufo wrote:
           | Another advantage of autofill is that it's more resistant to
           | phishing attacks.
        
         | 14 wrote:
         | I have always felt the same. For me it is easy enough to have a
         | little password book with everything written down. People often
         | say what happens if there is a fire. I don't have an answer to
         | that but I have made it over 4 decades and not once had a fire
         | so I'm going to believe the odds are I will not ever have a
         | fire and chance it. Most things are recoverable with my phone
         | number these days anyways. A much greater risk would be someone
         | gaining access to my phone
        
           | dotancohen wrote:
           | If you have a fire, you'll just do what my wife does with
           | _every_ password field she needs to use. You'll press the
           | "forgot password" button.
           | 
           | God help her if she needs to log into her email after I'm
           | dead.
        
             | [deleted]
        
         | daveoc64 wrote:
         | Aren't you incredibly vulnerable to Credential Stuffing
         | (https://en.wikipedia.org/wiki/Credential_stuffing)?
        
         | waboremo wrote:
         | You aren't avoiding this problem though, just like this exploit
         | requires physical access to disk, someone with physical access
         | to your piece of paper negates any benefits. Even worse when
         | people are recommending keeping your passwords in your wallet,
         | something people lose quite often and due to cash interest
         | there's a high incentive to stealing.
        
         | PeterisP wrote:
         | The whole concept of "my password" is horribly insecure, as if
         | you use the same password everywhere, there is a big risk that
         | one of the sites leaks your password and then all your accounts
         | are compromised. Whatever risks a cloud-enabled password
         | manager has, reusing a single password is so much worse that
         | those things aren't even comparable.
         | 
         | Having all your passwords on a piece of paper could be safer
         | than a password manager, but it's so inconvenient to store a
         | hundred different random passwords this way that people simply
         | won't do it and will reuse passwords. So if password managers
         | get people out of the password reuse trap, they're a net gain
         | in security, that far outweighs all the password manager risks.
        
         | StrangeATractor wrote:
         | I think Bruce Schneider recommended that most people should
         | just keep their password in their wallet.
        
           | jayknight wrote:
           | Source: https://www.schneier.com/blog/archives/2005/06/write_
           | down_yo...
           | 
           | But he also wrote his own password manager:
           | https://www.schneier.com/academic/passsafe/
        
       | mtlynch wrote:
       | I didn't find it so scary due to the fact that it requires the
       | attacker to read process memory. But then they pointed out that
       | if the process memory gets paged to disk, then an attacker can
       | recover the password from disk, which is admittedly scarier.
       | 
       | Still, it does require the attacker to either have root on your
       | machine or physical access to your disk. If the attacker has root
       | on your machine, it's game over anyway. You can mitigate the
       | threat of recovering the password from your disk by using disk
       | encryption.
       | 
       | Even when I hear about KeePass vulnerabilities, they're always
       | substantially less severe than the attacks we see on LastPass and
       | other web-hosted password managers where an attacker can
       | exfiltrate bulk credentials at once by compromising a server.
        
         | somat wrote:
         | Openbsd encrypts it's swap by default, you can jump through a
         | couple of hoops and encrypt your swap on linux. on windows, i
         | don't know, however, if you have an encrypted disk your
         | pagefile(if on that encrypted disk) will also be encrypted.
        
       | smcleod wrote:
       | Mods: the title should be changed to make it clear it's the
       | KeePass app for Windows, not the KeePass vault format as used by
       | many applications. It is not an exploit Keypass which is the
       | encrypted vault used by many applications - but a single client.
        
       | dist-epoch wrote:
       | The actual vulnerability:
       | 
       | > KeePass 2.X uses a custom-developed text box for password
       | entry, SecureTextBoxEx. This text box is not only used for the
       | master password entry, but in other places in KeePass as well,
       | like password edit boxes (so the attack can also be used to
       | recover their contents).
       | 
       | > The flaw exploited here is that for every character typed, a
       | leftover string is created in memory. Because of how .NET works,
       | it is nearly impossible to get rid of it once it gets created.
       | For example, when "Password" is typed, it will result in these
       | leftover strings: *a, **s, ***s, ****w, *****o, ******r,
       | *******d. The POC application searches the dump for these
       | patterns and offers a likely password character for each position
       | in the password.
       | 
       | https://github.com/vdohney/keepass-password-dumper
        
       | gnabgib wrote:
       | The source is
       | https://www.bleepingcomputer.com/news/security/keepass-explo...
       | (as referenced in the article). It goes into more technical
       | detail, and skips the antivirus sales pitch.
        
       ___________________________________________________________________
       (page generated 2023-05-20 23:01 UTC)