KeePass dev refuses to patch security hole in favor of ad revenue
-
@JaredBusch said in KeePass dev refuses to patch security hole in favor of ad revenue:
@thwr said in KeePass dev refuses to patch security hole in favor of ad revenue:
Ok, checked the article, it's about the updater... Still a problem, but no need for an immediate switch IMHO.
As someone contemplating switching to it though, I no longer wish to.
Wouldn't do it either in this case, but there should be no real risk for existing users as long as you don't use the auto updater.
Anyway, please report back when you found something, FOSS preferred.
-
Security issues in auto updaters are a big problem. Most of them are prone to man in the middle attacks because they just don't use encryption and / or checksums.
-
@thwr said in KeePass dev refuses to patch security hole in favor of ad revenue:
Security issues in auto updaters are a big problem. Most of them are prone to man in the middle attacks because they just don't use encryption and / or checksums.
This is especially troubling on mobile devices, something I would expect you to want this type of software the most. yeah this is a pretty big problem - sadly, one I'm guessing it's had since day one. or when they decided to do whatever they do with advertising.
-
@Dashrender said in KeePass dev refuses to patch security hole in favor of ad revenue:
@thwr said in KeePass dev refuses to patch security hole in favor of ad revenue:
Security issues in auto updaters are a big problem. Most of them are prone to man in the middle attacks because they just don't use encryption and / or checksums.
This is especially troubling on mobile devices, something I would expect you to want this type of software the most. yeah this is a pretty big problem - sadly, one I'm guessing it's had since day one. or when they decided to do whatever they do with advertising.
Less of an issue on mobile devices the respective app stores handle it and it's much more secure
-
@Jason said in KeePass dev refuses to patch security hole in favor of ad revenue:
@Dashrender said in KeePass dev refuses to patch security hole in favor of ad revenue:
@thwr said in KeePass dev refuses to patch security hole in favor of ad revenue:
Security issues in auto updaters are a big problem. Most of them are prone to man in the middle attacks because they just don't use encryption and / or checksums.
This is especially troubling on mobile devices, something I would expect you to want this type of software the most. yeah this is a pretty big problem - sadly, one I'm guessing it's had since day one. or when they decided to do whatever they do with advertising.
Less of an issue on mobile devices the respective app stores handle it and it's much more secure
Good point.
-
This post is deleted! -
I think KeePass with Chocolatey would bypass the insecure updater.
-
What about this one...
-
How does the HTTP update check create ad revenue? I haven't seen that explained.
The program won't update itself, you have to manually go to sourceforge.net and the developer's point that digital signatures are more secure than just using HTTPS anyway seems to make sense.
I don't see the issue. I'm happy to continue to use Keepass.
-
@Carnival-Boy said in KeePass dev refuses to patch security hole in favor of ad revenue:
How does the HTTP update check create ad revenue? I haven't seen that explained.
Lost on that one here, too. I've never seen any ads associated with Keepass.
-
If anyone is worried the MD5 and SHA1 match.
-
I find this quite sad, actually. I've been a happy Keepass user for a while now... Guess I'll check out some of the others now. KeePassX looks pretty good.
-
@dafyre Once again, the problem is the updater, not the program it self. I think at the end of the day, it will be fixed.
-
@aaronstuder said in KeePass dev refuses to patch security hole in favor of ad revenue:
@dafyre Once again, the problem is the updater, not the program it self. I think at the end of the day, it will be fixed.
Or forked.
-
@aaronstuder said in KeePass dev refuses to patch security hole in favor of ad revenue:
@dafyre Once again, the problem is the updater, not the program it self. I think at the end of the day, it will be fixed.
True. But for an application such as Keepass, why risk it? KeePassX works fine with my existing database, and I no longer have to worry about an auto updater hijacking my passwords or otherwise infecting my computer with bugs.
Note: I'm not terribly worried about it... but a little paranoia is safe when it comes to security.
-
@scottalanmiller said in KeePass dev refuses to patch security hole in favor of ad revenue:
I think KeePass with Chocolatey would bypass the insecure updater.
There is also the option of just not installing it.
For a number of years I have used the Portable App version.
-
@dafyre said in [KeePass dev refuses to patch security hole in favor of ad revenue]
and I no longer have to worry about an auto updater hijacking my passwords or otherwise infecting my computer with bugs.
There is no auto-updater. You have to manually download new versions from sourceforge. All this (non) issue is is a program that notifies you if there is a new version and advises you to (manually) download it.
-
@Carnival-Boy said in KeePass dev refuses to patch security hole in favor of ad revenue:
@dafyre said in [KeePass dev refuses to patch security hole in favor of ad revenue]
and I no longer have to worry about an auto updater hijacking my passwords or otherwise infecting my computer with bugs.
There is no auto-updater. You have to manually download new versions from sourceforge. All this (non) issue is is a program that notifies you if there is a new version and advises you to (manually) download it.
But said "update now" popup can redirect you wherever it wants assuming a hacked update popup. I know I'm pushing it, but as I said... a little paranoia can go a long way.
-
How does the popup that there is an update happen? Assuming it's that the app checks a website, we're just in for another Firesheep adventure.
-
I use Keepass and update via Ninite Pro. And I have never seen anything to do with ads in the 10 years I have been using it.
