Hacker News Reader

Why is there advertisement on the automated update server? Why can't he just split them apart? What with things like Let's Encrypt nowadays, there really shouldn't be any excuse not to use https. Especially for a security related product!

View on HN

There isn't an automated update server. KeePass can't auto-update. The web server has a text file on it that contains the version number of the latest release. KeePass (optionally) checks that file to see if a new version is available and displays a notification to the user. Downloads and installation of new versions has to be done manually by the user. The binaries are hosted on SourceForge and other mirror sites, and in my cursory checking those are serving the file over HTTPS. The binaries are digitally signed.

So any possible attack against KeePass would as most cause the notification dialog to appear saying there's a new version.

anyway, the author found a solution by signing the text file that the update checker looks at. IMO, that's a superior solution to HTTPS. He's posted a statement on the KeePass website. http://keepass.info/help/kb/sec_issues.html#updsig

Reply on news.ycombinator.com