How does KeePass2 rank in security against other password managers?
I've used it for a while, and haven't heard either way. The Android app has good Dropbox integration, which really streamlines mobile password use.
I've used it for a while, and haven't heard either way. The Android app has good Dropbox integration, which really streamlines mobile password use.
The fact that it is offline, open-source, and (on Windows) uses the standard Win crypto libraries gives it an advantage over Lastpass or 1Password.
Here's a thread[0] from last year bringing up some issues with KeePass2 code. It also links to an audit by some group that appears to be involved in information security for the French government[1]. It's in French. The HN comment asserts the audit found KeePass2 2.10 portable to be safe; I don't comprehend French so I don't know what the audit says.
The documentation[2] specifies that the default KDF uses 6000 rounds of AES, although that is configurable, so presumably 'hahaha...extremely fast cracking speeds' could be improved to 'fast cracking speeds' or even 'moderate to slow cracking speeds'.
KeePass has had one published vulnerability[3]; it applies to KeePass v1.17, so should not be a concern anymore.
I will continue to use KeePass2.
[0] https://news.ycombinator.com/item?id=9727297
[1] http://www.ssi.gouv.fr/uploads/IMG/cspn/anssi-cspn_2010-07fr.pdf
[2] http://keepass.info/help/base/security.html#secdictprotect
[3] https://www.cvedetails.com/product/23054/Keepass-Keepass.html?vendor_id=12214If the keepass docs are up to date, the default for the desktop application is only 6000 rounds which I feel is too low.
I've noticed that the Keepass2Android app uses a 500K default instead.