KeePass is an open-source password manager that does all the things you’d expect a password manager to do at the very least – it stores all websites and service credentials in a highly-encrypted vault that can only be unlocked with one Master Password, which becomes the only password you need to remember.īut a key difference between KeePass and cloud-based password managers is that KeePass is software you run locally – not an online service – and your KeePass vault is something you store in a location of your choosing. It’s a reasonable question – and there is an answer: KeePass. Understandably, many Naked Security readers have balked at this entire idea – Why should my online security be at the mercy of a third party that may, or may not, secure my data as well as I’d like? We’ve covered password managers in the past, and generally, our focus has been on some variant that stores your password data in the cloud, which means all that crucial data is on someone else’s computer. So if there’s one thing we suggest to everyone that will go a long way to improve their overall security, it’s using a password manager. Using that same easy-to-type password on every website and service you use practically rolls out the red carpet for an attacker into your online life. This one is certainly worth harping on about though: credential reuse. At least then it is your device, not someone else’s, so you have an idea of which crappy software is installed, which updates are missing etc.It can get a bit overwhelming for the average person to understand all the security-related best practices they might hear about online or at work. When on the go, better sync your keepass file to your smartphone and use e.g.
KEEPASSX ON USB DRIVE WINDOWS
This is similar with keepass, but again, keeweb is for the use case where this is not your system! Moreover, keepass for windows offers a “secure desktop” where you enter your master password which cannot be accessed by (off-the-shelf) keyloggers, keeweb doesn’t).
– the system you use (for example keyloggers can sniff your master password. – the browser you use (especially, keeweb is made for the use case when you are not at your own pc, so this is the browser of someone else, with a bunch of extensions installed and probably outdated). you need to trust the CA-system… or use cert-pinning) – the network connection between your system and the server (man-in-the-middle might replace keeweb with an infected version), or properly setup SSL (i.e. If keeweb is on dropbox, then you need to trust them. – the server that keeweb is stored on (an attacker might replace keeweb with some infected version on the server). If you use keeweb, you additionally need to trust: You need to trust your end devices anyway, as they are the place were you decrypt you keepass database. This means you only need to trust your end devices, not the server. You can secure your keepass file with a key-file that you don’t put into the cloud, making it really really hard for someone to brute-force if he gets access to your cloud storage. The good thing about keepass is that you can sync your passwords across devices through some cloud service like dropbox or owncloud without the need to trust the cloud service. Now You: Would you use a service like KeeWeb? The author promises that the app contains no statistics or analytics scripts or advertisement.
KEEPASSX ON USB DRIVE CODE
Since it is open source, you can audit the code to make sure of that. The remote version of KeeWeb makes no external requests, uses only locally stored data and makes only one network connection to check for updates which users can disable in the app settings. KeeWeb is something that I will keep an eye on definitely to see if creating your own self-hosted version of the application improves or is made clearer on the project website so that anyone with a Dropbox account but no knowledge of scripting or programming languages or Dropbox application creation can set it up on their own. I have no need for that, and won't use a service hosted by a third-party to open my KeePass database either.Ī self-hosted web version of KeePass on the other hand, that is open source, and easy to set up, should have appeal to users of the application. The desktop applications are cross-platform which may have some appeal to users of KeePass.
0 kommentar(er)
