Suspicious iOS KeePass Client

https://old.reddit.com/r/techsupport/comments/13nqarb/suspicious_ios_keepass_client/

by natrys • 3 years ago

283 164 3 years ago

old.reddit.com

quenix• 3 years ago

In retrospect, this seems like an obvious flaw in using third party clients for password management. The fact that KeePass is OSS is great, but it leads you to have to rely on these shady pieces of software to access your vault on non-officially supported platforms like iOS.

You wouldn’t have this problem if you used e.g. 1Password or Bitwarden. They have official iOS clients made by the same entity which you’ve already trusted with your secrets.

tl;dr Having to trust a third party KeePass client isn’t very smart and forces you to trust two (2) entities instead of one with your secrets. This is such a deal breaker that it might turn one off accessing their KeePass vault on iOS at all.

artjomb• 3 years ago

Exactly, as a user you need to be aware of this addition of risk. Anonymous OSS maintainers are the issue here. When I want to use a project and want to reduce the risk here, I need to vet the maintainers in a similar way I would vet a company I want to invest in.

bobmaxup• 3 years ago

I don't think there is a need to have someone's reputation score to use their software.

There are plenty of pieces of open source software running on operating systems that were contributed by people who are effectively anonymous.

Also, it doesn't seem like a contributor's overall character would be a great measure of how malicious their contriubtions are, as evidenced by plenty of examples of assumed good people eventually doing bad things.

TheDong2• 3 years ago

I mean, if you use 1Password on both linux and iOS, you now trust both the mobile and desktop teams at 1password. You trust two separate supply chains, one for the iOS app dependencies, one for the linux dependencies.

If you use bitwarden, you now trust the "bitwarden/mobile" and the "bitwarden/clients" repositories.

Both of those programs _also_ have separate applications with separate code for mobile and desktop, so for those you _also_ have to audit twice the code (well, not that you can audit 1password's code).

Anyway, if you're using any of these programs on desktop, you have to trust 100% of the programs you run as the same user as your password store client to not be reading memory to nab your database, so it's not like trusting one more program is that big a deal. I'm not even sure if I'm being sarcastic or not.

ec109685• 3 years ago

Two programs running under same user can’t by default read each other’s memory.

batmanthehorse• 3 years ago

That’s a stretch

o1y323• 3 years ago

That's just fearmongering. By that logic you can never use any closed source product. How would people trust an Outlook client won't leak your emails, or iOS/Android/Windows/MacOS isn't sharing your personal information and other communication?

WesolyKubeczek2• 3 years ago

This is one of those cases where, regrettably, decentralization and open sourceness can play out not very well, to say the least.

Someone can make an API, a library, a file format, which is bona fide good, and for good purposes. They leave the implementation for platforms they don't care about to others, because why not? And then someone makes an app which looks totally legit, is open source even. You end up thinking that the fact it's open source is by itself enough clout to trust the app.

But the thing is, there's so much code in the repositories added every day that no one will be able to give it enough eyeballs so that all the shady bollocks it does are shallow. Malware authors don't even have to particularly hide the malicious bollocks away, or compile their published app from different sources. And if you chase them down, they rebrand, do SEO, and publish two new totes legit looking apps for each one you get to take down.

Centralized services like Bitwarden (LastPass left a bitter taste in my mouth) come with their own sets of problems, but at least they have a company behind them whose site can be verified as belonging to them and pointing to the correct version of their official client app.

fauigerzigerk2• 3 years ago

This is one of those cases where, regrettably, decentralization and open sourceness can play out not very well, to say the least.

I think this is one of the cases where the problems of decentralisations are exacerbated by the problems of centralisation.

It's hard enough to vet a github repository, but at least it can be done.

After funneling the code through an intransparent, centralised review process that claims to ensure "the highest standards for privacy, security and content" you can no longer verify anything.

WesolyKubeczek2• 3 years ago

It's hard enough to vet a github repository, but at least it can be done.

It will, more often than not, fall victim to the bystander syndrome. Someone else will do it, right? Right?

Well, in fact, nobody will do it. Here's why: a KeePass client is already a niche piece of software; people who are aware of it and would like to use it on their iOS devices form a small subset of all KeePass users; of those, people who have actual chops to perform a review of source code, are an even smaller subset; of those, people having enough spare time and brain cycles to be bothered is a number very close to zero, or can be counted on a drunk carpenter's fingers. Those people will maybe carve time to look once they suspect something fishy is happening.

maratc• 3 years ago

Tangentially related question: What is the [recommended|best|most used] iOS KeePass client? The KeePass site recommends MiniKeePass that's been archived for a couple of years already.

ajdude• 3 years ago

I'm a very happy user of strongbox: https://strongboxsafe.com/

I currently sync my vault via WebDAV and they even support storing the local keyfile.

prophesi2• 3 years ago

Same here. Nextcloud to sync the database, and a local keyfile that doesn't touch the internet/cloud.

It's also open-source under AGPL, though iOS doesn't have anything like F-Droid to verify builds.

https://github.com/strongbox-password-safe/Strongbox

shocks• 3 years ago

I’m using Strongbox also.

garganzol3• 3 years ago

KeePass Touch works reasonably well.

k8sToGo2• 3 years ago

I’m a fan of KeePassium

sebazzz• 3 years ago

KeePassium is awesome, as it also integrates on the iOS level as a password auto-fill solution.

bee_rider• 3 years ago

Looks like it is riffing off the name of the dearly departed MiniKeePass.

sammachin• 3 years ago

The problem is there’s no way to truely publish OSS on the iOS App Store (or Play store) you submit a binary to Apple and you can publish a repo to GitHub but AFAIK there’s no way to correlate that those two things are the same. So unless you build the app from source yourself there could be anything in the binary.

emsy2• 3 years ago

You just made the case for how sideloading can be more secure than a centralized App Store.

2muchcoffeeman2• 3 years ago

That’s not really a solution to this either, because security can’t just be for people who know how to compile and side load apps.

NovemberWhiskey• 3 years ago

How so? Side-loading an arbitrary binary is no safer (arguably less safe) than downloading a binary from the App Store.

concinds• 3 years ago

This increases verifiability. Not security. And it's not the real issue.

On Linux, many apps are open-source yet users don't compile them themselves; they trust that their distro vets packages properly before making them available in official repositories.

In this situation, the problem isn't the lack of reproducible builds, but insufficient oversight by Apple that led to an untrustworthy package being made available in their "repository" (App Store).

djxfade• 3 years ago

But that point applies to binary distribution outside an app store as well. How can you know that the binary linked from a GitHub repository is built from the same source?

haliskerbas• 3 years ago

The os can tell you a checksum in the settings page or before installing.

Or you can build from source and confirm on your own.

soraminazuki• 3 years ago

That's why I prefer distro-built packages over upstream binaries wherever possible. It greatly reduces the number of build and distribution platforms that I have to trust.

mch82• 3 years ago

Can the binary be attached to the GitHub repo as a release so that the binaries can be compared?

lxgr6• 3 years ago

The problem is that the App Store encrypts each binary to a device-specific key for DRM purposes, and it's not possible to disable that.

Additionally, how would you even calculate a binary hash of an iOS app? The filesystem is locked down.

I suppose the OS could provide a way to list binary hashes (either after DRM decryption or for non-DRM-ed binaries, if that ever becomes an option), which would be slightly better if you trust the OS more than the app store, which I personally do (it's much riskier to compromise all devices than to target a single device with modified app binaries).

tetrep• 3 years ago

It'd be cool if you could submit a specific Github commit (or similar) and then have the app store build it and distribute it. Then the user only needs to trust Apple or Google to not be malicious, which they kinda already need to do if they're using both an OS and app store from them.

dingledork692• 3 years ago

But then apple couldn't gouge every app developer for an additional 2k. Right now you must buy a Mac to have the privilege of building and uploading iOS apps.

dingledork692• 3 years ago

I thought the approved by apple line of thinking was that the app store is a mecca of safe and trustworthy apps?

whamlastxmas• 3 years ago

Glad I saw this. I have this installed on my phone too, though I thankfully possibly never used it? I mostly only ever use FF password manager these days and I haven’t updated any keepass entries for 2 years.

Going to change all my keepass saved passwords regardless

fodi• 3 years ago

I'd stay away from any KeePass clients with network access. I don't have a recommendation for iOS, but for Android KeePassDX [0] seems like a good option as it has no network permission to begin with.

[0] https://www.keepassdx.com/

m-p-32• 3 years ago

There is also Keepass2Android Offline

https://play.google.com/store/apps/details?id=keepass2androi...

k8sToGo2• 3 years ago

For iOS I use KeePassium. A paid app.

KeePassium• 3 years ago

To be precise, KeePassium is a freemium app (free tier + some premium features)

ssbash6• 3 years ago

Strongbox is a fantastic KeePass client on iOS and macOS. They offer a fully offline version called Strongbox Zero.

https://strongboxsafe.com

arepublicadoceu2• 3 years ago

How do you attest this without simply trusting the dev or monitoring package data transferred by the app?[1] iOS, differently from Android, doesn’t have a explicit network permission that the user can verify.

All apps have network access by default and there’s nothing you can do about it without jailbreaking.

[1] as many pointed out: open source in iOS is a moot point as there’s no way to verify the binaries.

master_crab• 3 years ago

+1 for strongbox.

Have been using it for 3-4 years now. Its integration with the Apple ecosystem is second to none. I do use an online version that syncs with iCloud so I can access it anywhere (but with a Yubikey).

thepill• 3 years ago

Would android require you to accept new permissions if network access would be imemented "sometime"?

nightpool2• 3 years ago

How do you suggest keeping your database in sync between your desktop and mobile device? I use Keepass2Android and I'm 100% happy with it, because it has incredibly good Dropbox sync support. I don't think throwing out every single networked feature just because of one malicious app is a reasonable or proportionate response.

Besides, I'm sure some clever attackers could think long and hard and come up with plenty of covert exfiltration channels without even needing direct network access. For example, adding a "safety redirect" every time you open your web browser, like t.co does.

mFixman• 3 years ago

Can't you store the database locally and then have Dropbox or Google Drive upload it to your drive?

It's still not 100% secure, but you would need both a compromised Keepass app and a compromised Dropbox app.

gavaw• 3 years ago

Correct me if wrong but you don't need to request network permissions to be able to make outside connections.

Almost all apps make outside connections and it would make no sense to prompt the user for that.

vanous• 3 years ago

If you don't declare network access in the app manifest, your app cannot make a network connection. If you declare network access, app can make a network call and user confirmation is not required. It is thus very easy to check for apps that are truly offline.

iillexial• 3 years ago

I would never use Keepass client on the mobile device. I have 0 trust to what developers have published there. If I need to type a password on mobile device, I will do it manually.

lifty2• 3 years ago

Too bad operating systems allow full internet access for applications that shouldn’t. Hopefully this security feature will one day be implemented in popular operating systems.

dchest• 3 years ago

It is implemented (sandbox permissions), but it's controlled by developers.

lifty2• 3 years ago

At least I would like to see when installing an app if it requires full internet access or what hosts it requires access to.

garganzol3• 3 years ago

BTW, the GitHub profile of the repository owner points to a sketchy website [0] which looks somewhat plausible from the first glance, but then more like a content stub on a closer inspection.

[0] www.unicomedv.de

Update: the reason I think it is more a content stub than a real thing is because there are no trial downloads available for theirs desktop products, and that's a red flag. Some site sections like "Office 365" represent a total nonsense with buttons leading nowhere. The pricing page has gray-on-black text elements, so looks clearly deoptimized for performing any real conversions. The whole site gives a strong fly-by-night vibe.

MrGilbert• 3 years ago

According to Northdata[0], the Managing Director has been part of the now-defunct "Black Diamond Suxess Club GmbH", which allegedly has been running a Ponzi scheme[1].

Also, if you look up the address, it's not an office complex. It's a residential area with single-family homes.

[0] https://www.northdata.com/M%C3%BCller,+Montgomery,+K%C3%B6ln...

[1] https://www.bekm.us/black-diamond-suxess-club-gmbh-mario-ore...

garganzol3• 3 years ago

if you look up the address, it's not an office complex. It's a residential area with single-family homes.

And I bet there are no Wozniaks in that garage.

bdcravens• 3 years ago

Also, if you look up the address, it's not an office complex. It's a residential area with single-family homes.

I don't like considering this a signal. We want indie developers to flourish (a business name is little more than paperwork that anyone can get), and it's too easy for the nefarious to buy a "virtual office" in a legit-looking office building that is little more than a PO Box.

pevey• 3 years ago

I was coming here to say the same thing. It's really amazing that they used their own domain name to receive the payload from this malware analytics code. Possibilities are (1) all of the people associated with this company are not real people (faked LinkedIn profiles and everything), (2) they are really, really dumb, or (3) it was a roque employee/contractor who saw an opportunity to set this up and skim some cream.

Wronnay• 3 years ago

there are no trial downloads available for theirs desktop products

They have a contact form and it's quite normal here in Germany that you have to contact the business first before you can download the business software.

All in all most normal small IT companies I know in my area have a similar looking website.

Which makes it more unserious is that one of the Managing Directors has done shady business in the past.

quyleanh• 3 years ago

Wait. I just thought iOS App Store has manual review process with human? And it gains reputation by kill all suspicious applications before published to App Store?

zamadatix• 3 years ago

Nothing in security catches "all" things. A review process with a human may be good but it's far from turning humans into infallible detectors. The reputation gained by the App Store is by catching many such apps before they are published, not every single one.

eternauta3k• 3 years ago

If this is malicious, then I don't understand why the evil code was in the public repository instead of just in the binary.

nightpool2• 3 years ago

because people are stupid and maintaining a separate private fork is more annoying than it's worth?

lxgr6• 3 years ago

If the intention here was really to steal passwords, it could also be deniability?

Uploading sensitive stuff to logging and/or analytics packages or third party providers is a surprisingly easy mistake to make – which in turn makes it an excellent avenue for plausible deniability.

It can be really hard to tell which one it was without inside information or a detailed investigation.

zouhair2• 3 years ago

From KeePassXC FAQ, suggested mobile apps[0].

[0] https://keepassxc.org/docs/#faq-platform-mobile

egberts123• 3 years ago

My running note on self-hosted password managers:

1password: since version 8, dead due to cloud-only-now, not standalone, its over-usage of Electron web and its many unverified modules/libraries; remote storage of password only in encrypted form. Key stays offline.

vaultwarden: yet another Electron web app and its usage of many unverified modules/libraries; remote storage of password only in encrypted form. Key stays offline.

NordPass: best zero knowledge remote storage; has apps for Windows, macOS, Linux, Android, and iOS. When it comes to browser extensions, one would be hard-pressed to find a wider selection. You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge. Not open-source.

LassPass, hacked in 2022; remote storage of raw passwords

pwsafe, still is the safest CLI-only solution to date. The design of pwsafe (Password Safe CLI) got started by Bruce Schnier, the crypto security privacy expert. In pwsafe, unbroken TwoFish algorithm is still being used instead of currently safer Argon2i, simply because it's faster (after millions of iterations). The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany) PasswordSafe with YubiKey but stay away from its web-client variants due to ease of memory access to JavaScript variable names (by OS, browser, JS engine, and JS language)

Only downside for ANY PasswordSafe-design GUI client is trusting yet another app repository source.

js22• 3 years ago

I'll add a self-hosted option that no one ever mentions – PasswordWallet:

https://www.passwordwallet.com/

I use iCloud Keychain for most of my passwords these days, but my critical passwords I continue to keep in PW as well.

PW also has an occasionally very useful feature that I have not seen in any other password manager: auto type. Sometimes I just need to point my cursor somewhere and have the password typed for me (e.g. into a login screen on a VNC/RDP connection).

PW uses Blowfish with 448-bit keys.

There is also "pass" (from the author of Wireguard) which is essentially a shell script wrapper around gpg and git:

https://www.passwordstore.org/

sgu999• 3 years ago

I've been using "pass" for years and love it. There is also a very nice iOS app that works well and is open source. I synchronise my devices and backup directly without a central repo. Its only flaw is gpg's poor UX...

egberts123• 3 years ago

Yeah. Auto-typing of password-related field is a relatively new security feature that got its start in Apple iOS.

While password auto-type is also found in Android, its security model is not quite a firm Bell-LaPadula yet like those implemented in Apple iOS/MacOS.

Exposing API to monitoring keystrokes remains problematic for any OSes.

egberts123• 3 years ago

Ooooooo, if the passwordstore has a bash autocomplete in which to navigate selections of its config file subdirectories, then the solution becomes incredibly robust.

rcme• 3 years ago

Why would you store critical passwords in two places?

Kwpolska2• 3 years ago

pass is fine if you like gpg (why?) and the only machines where you need those passwords are Linux/macOS/*nix computers. There are ways to access it on Windows, Android, and iOS, but they are unbearably painful.

yoyohello132• 3 years ago

No Bitwarden?

sphars• 3 years ago

They mentioned vaultwarden, which is a self-hosted backend for Bitwarden

Dalewyn• 3 years ago

You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge.

So Chrome, Firefox, Safari, Chrome, Chrome, Chrome, and Chrome?

egberts123• 3 years ago

Update: this post is wrong. Edge preserves and utilize Chrome app APIs.

AFAICT, There is nothing Chrome about Edge.

lxgr6• 3 years ago

LassPass, hacked in 2022; remote storage of raw passwords

I know that it's been one dumpster fire after the other in the past few years, but did they actually go as far? The most severe one I remember hearing of was a leak of (possibly insufficiently salted, depending on the age of the account) encrypted password vaults. Still, I'll never again consider or recommend them going forward.

In pwsafe, unbroken TwoFish algorithm is still being used instead of currently safer Argon2i

This is actually a negative point for it, in my view. AES is just as unbroken, yet has received considerably more scrutiny over the years.

The only place were non-AES symmetric algorithms still make sense these days is platforms where hardware acceleration is not available (e.g. djb's Salsa/Chacha), and even there only for high-throughput applications, which a password safe decidedly isn't.

The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany)

I've never heard of them. Is it open source or at least properly audited?

egberts123• 3 years ago

Update: This post is half-wrong; Salsa is a streaming cipher and AES is a block cipher and one still need a PBKDF mechanism to construct a safer key.

Problem with AES and Salsa is that salting is required for smaller-sized password and are not considered a "hashing" algorithm; those two are block ciphers, as I recall.

No, MATESO is not open source but with an enterprise license, you can negotiate for the source code. And they have contracted audits against their software.

Netwrix PasswordSafe is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA compliance but that is a moot point for most SMBs, SMEs, family-servers and homelabs.

egberts123• 3 years ago

"AES-KDF in KeePass is only CPU hard, while Argon2 is both CPU and RAM hard. This means that AES-KDF is victim to GPUs and ASICs for fast password cracking. The memory requirements in Argon2 make GPUs and ASICs considerably more expensive to reach similar password cracking speeds."

https://www.reddit.com/r/KeePass/comments/k511o6/comment/ged...

ssbash6• 3 years ago

Strongbox is a fantastic KeePass client on iOS and macOS.

- fully native apps

- open source

- fully offline option (Strongbox Zero)

- one time purchase

- solid browser extensions for Chrome and Firefox

- native keychain autofill for Safari and Orion

- compatible with other KeePass apps on other platforms

- multiple sync options iCloud, G Drive, Dropbox, OneDrive, SFTP, WebDav, Syncthing

- support for offline vaults

- biometrics, Apple Watch unlock, and Yubikey support

- TOTP codes, attachments, and markdown notes can be stored

- supports password auditing with Have I Been Pwned

- supports importing 1PW vaults

Most importantly, Strongbox is made by a small and transparent company. Unlike Bitwarden or 1Password, they are solely focused on making high quality macOS and iOS apps.

https://strongboxsafe.com

egberts123• 3 years ago

I really really like Strongbox.

My only resistance from going the route of strongboxsafe is the lack of app-specific PIN, opposed to OS-specific PIN that is still missing from the free version.

While a master password covers the specific database, the PIN covers the app.

This is a problem for me there:

1. No OS-specific PIN/passcode in free version

  A wider acceptance should borne with this simple feature in the free version.

Also Netwrix is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA ready but that is a moot point for most SMBs, SMEs, family-servers and homelabs.

I do do like the simple fact that Strongbox has it all out with their Github repository.

https://github.com/strongbox-password-safe/Strongbox

bbx2• 3 years ago

one time purchase

I can only see a monthly or yearly subscription option?

bombcar• 3 years ago

This might be what I need to finally get off the stupid 1pass treadmill.

SSLy• 3 years ago

NordPass

I haven't seen a website this aggresive if you dare to open it in uBo in quite some time. Scroll down one screen and it constantly reloads.

I'll stay with 1p.

dataflow• 3 years ago

You don't have any notes on KeePass?

manmal2• 3 years ago

1P is zero knowledge. What does Nordpass really have over 1P?

egberts123• 3 years ago

Nordpass lets you self-host your password database.

1Password stop doing that and makes you use only their own cloud infrastructure.

Aaron2222• 3 years ago

Electron web and its many unverified modules/libraries

What do you mean by this? That Electron itself uses unverified modules/libraries, or that 1Password is? And do you have any citations for this?

o1y323• 3 years ago

"Electron web app"

That's the last thing I would worry about. I don't get why people would get annoyed at the implementation of UI if that UI is working well enough. Imagine someone says "although this password manager is very secure and has all the features I need, I don't use it because it uses web UI, even though the difference in performance would not matter at all compared to a native app".

Honestly I find this ridiculous and it is a waste of my time to write this comment. Who

egberts123• 3 years ago

You could wait until you are able to foray deep into the field of cybersecurity and vulnerability assessment and arrive to the same conclusion as I do.

Or you can Google "electron web vulnerabilities" and find out quicker.

pjmlp• 3 years ago

Unfortunately 1password has been a requirement in many projects I have been involved with.

egberts123• 3 years ago

You should post the name of those companies in here so we know who not to hire.

But I suspect you would be a contractor and probably would not be able to.

:-)

nkotov• 3 years ago

In case it wasn’t clear, the app in question is KeePassMini.

Here’s the AppStore link: https://apps.apple.com/us/app/keepassmini/id6446373282

heisenbit• 3 years ago

Did or will Apple inform affected users? If not how could Apple maintain the argument the app store provides protection?

crop_rotation3• 3 years ago

One such incident doesn't eradicate Apple's argument. By that logic one bad sideloading incident would undermine the logic that sideloading can be safe.

crop_rotation3• 3 years ago

Unfortunately neither iOS nor Android allow you to totally disable internet access on a per app basis. On Android side manufacturers like Xiaomi do allow it, but nothing built in for all. There is Netguard on Android atleast. I really think it should be possible to disable internet access on a per app basis.

Nextgrid2• 3 years ago

Ironically enough, iPhones for the Chinese market allow you to disable an app's network access completely. Non-Chinese-market ones only allow disabling mobile data but not Wi-Fi.

crop_rotation3• 3 years ago

If they already have the feature then it makes even less sense to not give it to everyone. Like I would switch my phone OS just if there was a simple way to disable internet access totally for apps.

Nevicar• 3 years ago

next time, actually link the app in your github post to call them out rather than making an entirely cryptic post with names that can be easily changed and swapped around.

incredible security warning "hey this app that had its name changed may have been compromised". very established message that warns the other users that could have it. go search through the comments and hope its there instead!

mynameisvlad• 3 years ago

To my surprise the app I was using to read my KeePass database, iOSKeePass, was missing from App Store. It was deleted and I only owned a local copy.

What exactly would they link to? A dead App Store listing?

dt3ft• 3 years ago

The new listing.

joering2• 3 years ago

Just my 2c. I don't trust any cloud keypasses myself, and you shouldn't either. The way I been doing this is having a regular text file with all my passwords that is then encrypted by veracrypt and encrypted file container is then hosted in a pCloud. I used to do it with DropBox until one time their new version stopped doing bit-by-bit comparison, something pCloud does.

egberts123• 3 years ago

Updated:

password managers, self-hosted (revision 2)

1password: since version 8, now dead for self-hosting due to "their"-cloud-only-now, not a standalone, and its downside usage of Electron web and its many unverified modules/libraries; remote storage of password only in encrypted form. Key stays offline.

vaultwarden: yet another Electron web app and its usage of many unverified modules/libraries; remote storage of password only in encrypted form. Key stays offline.

KeepassXC, with syncthing: leading contender, best-self-hosted solution that stores password remotely only in encrypted form. but still has iOS unverifiable source code imposed by Apple. Key stays offline. For Keepass usage on iOS/macOS platforms, consider a lifetime (one-fee) StrongBoxSafe app (Keepass-compatible) instead.

NordPass: best zero knowledge remote storage; has apps for Windows, macOS, Linux, Android, and iOS. Self-hosted. When it comes to browser extensions, one would be hard-pressed to find a wider selection. You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge. Not an open-source.

LassPass, hacked in 2022; remote storage of raw passwords

pwsafe, still is the safest CLI-only solution to date. The design of pwsafe (Password Safe CLI) got started by Bruce Schnier, the crypto security privacy expert. In pwsafe, unbroken TwoFish algorithm is still being used instead of the currently safer Argon2i, simply because it's faster (after millions of iterations; also AES is not immune to hard-memory FPGA brute-force like Argon2, yet both remain hard-CPU). The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany) PasswordSafe with YubiKey. Only downside for ANY PasswordSafe-design GUI client is trusting yet another app repository and the compilation of "their copy of open source".

For any password manager, stay away from its web-client variants due to ease of memory access to JavaScript variable names (by OS, browser, JS engine, and JS language)

adultSwim• 3 years ago

https://web.archive.org/web/20230521122746/https://old.reddi...

JorgeFrias• 3 years ago

I feel your pain! So much that I built my own Local Password Manager -> Pocket Pass Manager [You get it? Pocket ≠ Cloud eh eh eh].

When LastPass moved from a free to a paid business model (paid-or-f%$k-you with users locked-in), I decided to build a password manager for myself, friends and family. I knew that password managers like One Password used only open source libraries for encryption, which made it seem simple to create a similar app, but improving the user interface and overall experience (I'm a sucker for great UIs).

This was before all LastPass fuck-ups, I (correctly) thought vault syncing was a bad idea, thus I took the local approach.

Building a local password manager has several advantages. Firstly, it avoids the risks involved in sending passwords over the internet. Secondly, there is no need for servers, meaning there are no fixed costs, forcing me to implement a subscription model. Lastly, users can be assured their passwords are secure, as they know where their passwords are at all times; for instance, you can check the app doesn't make any internet connections, and the encrypted sqlite database can be downloaded and audited.

Admittedly, I understand that other local password managers exist, but building my own was a fun personal project, developed to my satisfaction.

[I built this thing in pure Swift exclusively for iOS, as is what I used daily at Reliby (my startup-ish), and I wanted to try a 100% SwiftUI approach]

Before getting to code, one problem needed more thought: how to access the passwords from other devices? Macs have a shared clipboard, but I used Windows half of the time, I needed to find a way without compromising the security nor the locality. Inspired by Snapdrop and VLC's local upload, I came up with the idea of making the iPhone behave as a local web server, enabling users to access their keys on other devices on the same network (local network).

The first implementation, V1, used SSL (HTTPS) to encrypt the passwords payload, but the certificate couldn't be trusted, and some web browsers didn't accept it. Hence, I had to install the certificate on my computers, which ultimately became frustrating. However, this approach proved the concept could work. I ditched LastPass in just a couple of weeks!

For the second version (current is 2.3.0), I rewrote most of the code, focusing on creating a new web server approach that runs over unencrypted HTTP. The password payload is then encrypted with 256-bit AES using another key randomly generated on the explorer (client) that is transmitted to the phone by scanning a QR code. This approach ensures that even if someone is "listening" on the local network, they cannot obtain the key. What's more, users have a physical confirmation of the computer they were sharing the key with. Even if someone accessed the user's phone server, nothing would be transmitted without scanning the code. How cool is that?

Using the Pocket Pass Manager app, which is available in the App Store, users press "Share on the phone," access "jorges-iPhone.local," scan the QR code, and passwords (and other data) appear like magic on their other device.

The app also includes a built-in authenticator, credit cards, notes, offline security analysis of passwords, CSV import, and custom backups.

There is in-app purchase ($4) for adding over 20 passwords. However, those who cannot or do not want to pay can join the beta channel, where unlimited access is granted. Feedback is appreciated, but you should do backups as the app could experience bugs.

I cannot believe that my app's UI looks better than LastPass, which has millions of expenditure.

Here are the links if you want to try it out, I hope you like it. - AppStore: https://apps.apple.com/us/app/pocket-pass-manager/id15638393... - TestFlight (beta/free): https://testflight.apple.com/join/NeYmSS4B

Feedback is much appreciated.

Suspicious iOS KeePass Client

Related Stories