It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
avatar
trusteft: You actually trust a program to keep your password? You don't have paper or text files in your county? I don't know how people trust these programs.
avatar
DarrkPhoenix: Well, it might be due to KeePass being open source, storing passwords in a file encrypted with AES, and having been signed off on by a fair number of security and cryptography experts. But you're free to stick with text files and sticky notes.

I bet they are safer.
avatar
trusteft: I bet they are safer.

They aren't.
Any form of storing passwords will always have their downsides. Write in them down on paper/in a notebook, and you risk others reading them/losing that paper/notebook.
Store them in a text file, you risk the same. And if you rar that file and password protect it, you risk losing access to it in the event you forget that password.
Not to mention what happens if you lose that file due to any number of system based problems.
It's the same with Keepass. It can be locked to one user account (to which you risk losing access should anything happen to that user account), it can be locked with a password (which in essence is no different to storing a text file in a password protected file, it can be locked with a key file -- which again, is no real different to using password when considering losing access to that key file. Or any combination of the above can be used (and I'm sure you can then consider the problems that may follow).
Ultimately, whatever method you choose to store your passwords, they are all as weak as each other. Just choose the method you are happiest with and let others do the same.
avatar
trusteft: I bet they are safer.

Yes, reading the sticky notes on your fridge or opening "passwords.txt" from your desktop is a lot harder than cracking an encrypted data field.
Post edited August 19, 2010 by stonebro
avatar
trusteft: I bet they are safer.
avatar
stonebro: Yes, reading the sticky notes on your fridge or opening "passwords.txt" from your desktop is a lot harder than cracking an data field.

1)I don't place sticky notes with passwords or other "secrets" on the fridge.
2)I don't have text files named passwords with passwords on my desktop, and even if I did, no one else has access to my PC to see them.
As for the problems with having a program keep your passwords, bansama mentioned a few.
If you feel safer having someone else's program have your passwords, that's your issue, not mine.
I have the passwords in my brain. They're pretty safe there.
avatar
stonebro: I have the passwords in my brain. They're pretty safe there.

No, not really.
1)I don't place sticky notes with passwords or other "secrets" on the fridge.

Actually, keeping passwords on a sticky note at home is a very secure way to store passwords. Someone would have to break into your house, find your PC, write them down, to get at them. However, it's also very risky. Lose the paper and... oops! And it's inconvenient as well, unless you only enter passwords at home, or if you carry the paper with you, in which case, there goes the security of it...
2)I don't have text files named passwords with passwords on my desktop, and even if I did, no one else has access to my PC to see them.

This makes no sense in an argument against KeePass. If no one else has access to your PC to see those files, then they don't have access to see the KeePass database file either.
As for the problems with having a program keep your passwords, bansama mentioned a few.

He also detailed problems with NOT having a program keep your passwords. This isn't about KeePass being a perfect solution, it's about KeePass being a valid solution.
If you feel safer having someone else's program have your passwords, that's your issue, not mine.

This makes no sense. Do you enter passwords on your computer using a program that wasn't written by you from scratch (including web browsers or other applications)? Unless everything you enter a password into was either written by you from scratch, or the code was meticulously scrutinized by you, then you are trusting someone else's program with that password.
Not trusting KeePass is silly, it is an incredibly useful utility that makes password management FAR more convenient and safer than just remembering or writing down passwords. WIth KeePass, you can use super secure passwords like "SuKI2X%ra3p^r4hsM*N7Bf#yZCjz" without having to worry about losing them, or having to type them out every time you need them.
I'm sorry, but there is no valid security argument against using KeePass. Using KeePass is just as secure, if not MORE secure, than writing passwords down or memorizing them.
avatar
pacerdawn: I'm sorry, but there is no valid security argument against using KeePass. Using KeePass is just as secure, if not MORE secure, than writing passwords down or memorizing them.

That is a (too) bold statement there. There are valid security arguments indeed - one of them being that an open-source software is quite susceptible to trojans and utilities custom-made to "bind" to it. In such a way, a virus can tamper with the software, changing it enough to retrieve the actual passwords whenever the user retrieves them - and it can be done remotely, even. It's a long shot, of course, but definitely possible, perhaps even viable.
Another possible "attack" is having a resident trojan polling the clipboard and checking if there is a change not notified by the window system, which means some "secure" software is using it. And so on and so forth.
That being said, it looks like a fine piece of software, and pretty much safe if you have safe habits - but saying there is no valid security argument against it is going a bit too far.
This reminds me of what the book "Why Software Sucks" called the hassle budget.
Basically, the hassle budget is the balance between security and convenience. Greater security is naturally more inconvenient; what if you had to not only enter an ultra-complex text password, but also provide a hand scan AND a retina scan just to log in, among other things?
Most home users don't do anything that warrants such extreme levels of security, maybe except for anything that involves personal or financial information. Forum accounts and such definitely don't warrant it. Something like Steam may be in the middle.
Ultimately, though, if you're concerned about computer security, you probably wouldn't be on the Internet in the first place, or let anyone even have physical access to it.
avatar
DarrkPhoenix: Well, it might be due to KeePass being open source, storing passwords in a file encrypted with AES, and having been signed off on by a fair number of security and cryptography experts. But you're free to stick with text files and sticky notes.
avatar
trusteft: I bet they are safer.

Sticky notes can be more secure against certain kinds of attacks (it's hard to launch online attacks on non-digital information), but far more vulnerable against others (cohabitant that wants in to one of your accounts for some reason). There are also some definite cautionary tales out there regarding the storing of sensitive information on stickies (Stanley Rifkin was able to steal $10M with a couple of phone calls due to some bank employees writing down daily passwords). Text files are pretty much less secure across the board, as they have the same vulnerabilities as password management programs (e.g. file wiped out by drive failure if not backed up), but lack the layer of encryption to protect the contents of the file if an attacker gets their hands on it (either through an online attack or through physical access to the machine). Password management utilities also tend to win over text files on the usability front as they often have browser plugins that make entering passwords from the encrypted password archive extremely easy.
I imagine part of the concern you're trying to express is that the password management program might contain some kind of backdoor to send off all the passwords to an attacker, but with well-known and widely-analyzed programs this concern is basically paranoia on the level of being worried that Firefox could be sending off all your passwords to the Mozilla foundation.