Researchers demo weaknesses affecting some of the most popular options Academics say they found a series of flaws affecting three popular password managers, all of which claim to protect user credentials in the event that their servers are compromised.…
As usual, the actual best option (keepass in this case) gets no publicity.
What’s the best way to use a Keepass database on a phone?
I personally use syncthing to sync it between my devices and then keepassDX to load the database on the phone.
You can technically use any file sync service but, I would recommend having some form of retention system(syncthing does this for you) in play in case it does somehow corrupt.
I’m not sure it’s compatibility on apple products though as I don’t own any.
Keepass2android works pretty well. I’m not sure for iPhones
Keepassium is great on iPhones. You can sync through the files app (iCloud, smb,…) and it also has native connections to Dropbox, owncloud, nextcloud, WebDAV and more.
To be fair, it’s worth noting that the majority (all?) of the flaws were found around organization management, SSO, vault sharing and compatibility features. All of which severely expand the attack surface of any password manager, and hence should be avoided like a plague.
Also worth noting that the actual whitepaper (also linked in the article) is much better written than the article, and it was an interesting and easily understandable read. Give it a go.
And thanks for sharing!
Probably?
Since end-to-end encryption is still relatively new in commercial services, it seems that no one had ever examined it in detail before…
SourceOh really?! Tell me about it!
In addition to KeePass, some may find “Pass” interesting, that is based on GnuPG - https://www.passwordstore.org/
Pass is what I recommend
As one of the most popular alternatives to Apple and Google’s own password managers, which together dominate the market, the researchers found Bitwarden was most susceptible to attacks, with 12 working against the open-source product.
Shit
I think there is an important distinction that all of the attacks are against the client connection to the compromised server, they’re not able to decrypt the data at rest.
Hopefully each organization hardens against these discoveries.Nice article. I’ve been using Keepass for many years but, as someone whose been looking to switch to Linux, this is very intriguing.
