Password Manager

[xlr]

Ako su iste kao onda - svakako bih promjenio.

[The Exiled]

Friški nastavak LastPass sage ...

• LastPass: DevOps engineer hacked to steal password vault data in 2022 breach
  
  
• LastPass Reveals Second Attack Resulting in Breach of Encrypted Password Vaults
  
  
• LastPass says employee’s home computer was hacked and corporate vault taken

Ukratko, pokradeno im je sve moguće.

[Dottore]

Ja sam otišao od 10mj i još nisam imao problema.

[Neo-ST]

Keepass vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2023-32784

[The Exiled]

• For the PoC tool to work, you need the process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys) or a RAM dump of the entire system.
  
  
• It has been fixed in the test versions of KeePass v2.54 – the official release is expected by July 2023.
  
  
• KeepassXC – a fork of KeePassX, which is a cross-platform port of KeePass – is not affected.

[Neo-ST]

Opet Keepass? https://twitter.com/ghidraninja/stat...60231111598080

[The Exiled]

Nema veze s KeePassom, ovo je neki/nečiji iOS KeePass, dok je ovdje popis pravih službenih iOS aplikacija.

[Night]

Autor Neo-ST

Keepass vulnerability:

https://nvd.nist.gov/vuln/detail/CVE-2023-32784

Najnezgodniji dio je ovo što navodno može ostaviti plaintext password u pagefile.sys, još jedna preporuka za koristiti full-disk encryption.
Probao sam runati PoC kod na jednom pagefile.sys dumpu sa kompa koji ima KeePass ali nije mi ništa izbacio, memory dump još nisam testirao.
Autoru kao da se baš ne žuri sa ispravkom ovog dosta ozbiljnog propusta.

[The Exiled]

KeePass 2.54 released

New Features:

• Triggers, global URL overrides, password generator profiles and a few more settings are now stored in the enforced configuration file.
• Added dialog 'Enforce Options (All Users)' (menu 'Tools' → 'Advanced Tools' → 'Enforce Options'), which facilitates storing certain options in the enforced configuration file.
• Export confirmation dialog banners now have a yellow-orange background.
• In export confirmation dialogs, the text of the 'OK' button is now changed to 'Confirm Export'.
• In report dialogs, passwords (and other sensitive data) are now hidden using asterisks by default (if hiding is activated in the main window); the hiding can be toggled using the new '***' button in the toolbar.
• The 'Print' command in most report dialogs now requires the 'Print' application policy flag, and the master key must be entered if the 'Print - No Key Repeat' application policy flag is deactivated.
• The 'Export' command in most report dialogs now requires the 'Export' application policy flag, and the master key must be entered.
• Single line edit dialogs now support hiding the value using asterisks.
• On Unix-like systems, commands that require elevation now have a shield icon (like on Windows).
• TrlUtil: added 'Move Selected Unused Text to Dialog Control' command.

Improvements:

• Improved process memory protection of secure edit controls.
• The content mode of the configuration elements '/Configuration/Application/TriggerSystem', '/Configuration/Integration/UrlSchemeOverrides' and '/Configuration/PasswordGenerator/UserProfiles' is now 'Replace' by default.
• The built-in override for the 'ssh' URI scheme is now deactivated by default (it can be activated in the 'URL Overrides' dialog).
• When opening the password generator dialog without a derived profile, the '(Automatically generated passwords for new entries)' profile is now selected by default, if profiles are enabled (otherwise the default profile is used).
• Improved UI update performance in the password generator dialog.
• Improved and renamed dialog banner styles.
• The separator line of light dialog banners is gray now.
• Improved serialization/deserialization of custom configuration settings (used by plugins).
• Improved reporting of unknown database header fields.
• On Unix-like systems, the clipboard workarounds are now disabled by default (they are not needed anymore on most systems).
• Improved clipboard clearing on Unix-like systems.
• Improved starting of an elevated process on Unix-like systems.
• TrlUtil: improved keyboard shortcut assignment and toolbar construction.
• Installer: the desktop shortcut is now created for all users (if the option 'Create a desktop shortcut' is activated).
• Installer: removed the Quick Launch shortcut option.
• Upgraded installer.
• Various UI text improvements.
• Various code optimizations.
• Minor other improvements.

[kreso75]

Autor The Exiled

KeePass 2.54 released

Jesu ispravili sigurnosni propust da se može doći do master passworda na Windowsima?
Iz opisa na "New features" i "Imporvements" mi se ne čini da su to naveli...