If you're buying a .info or adding "Origin" after your name, then it's time for a rebrand. You scrape together pennies in your stubbornness at the massive expense of filling the coffers of the bad actors and screwing your users with confusion. Especially for security software.
You could have written a good version of this comment that said something like "KeePass should rename, that's in the best interests of its users". Try to write constructively here.
To turn this thread into something more constructive: it might be a good idea to report it to https://safebrowsing.google.com/safebrowsing/report_phish/ to make sure it gets Google's attention, and hopefully warns people browsing the site.
Also, in my experience, Google is very receptive to and decisive on phishing and malware complaints. I've worked on websites that are constant phishing/malware targets and Google moved quickly with us on getting that "this is a malicious website" splash page into Chrome.
Since this has been going on for a year, I'd be shocked if the Keepass people even tried. Not even a mention of it on their homepage to help their users pick the legit one?
> If you're buying a .info or adding "Origin" after your name, then it's time for a rebrand. You scrape together pennies in your stubbornness at the massive expense of filling the coffers of the bad actors and screwing your users with confusion. Especially for security software.
So, apparently, according to you, not owning the .com equivalent to your non-.com domain means you're incompetent. Has it ever occurred to you that not everyone is from the USA? If you're supposed to own the .com domain anyway then why ever bother with non-.com domains? All non-.com domains are obsolete according to your reasoning, including .net and .org and CCTLDs.
Also, this is non-commercial, free as in beer, FOSS. Where was your donation to the project?
Also, I think indifference is a better accusation here than incompetence.
If I had to summarize my point of view across the various posts I've made here, it's that I think they are failing all the good folks who made the mistake of looking up Keepass after hearing that it would help them take an important step of cyber security in their life, getting fooled by an imposter, and getting pwned.
Well, that is to keep it brief because there's not much to refute on the other two 'things'...
> letting this happen, and then letting your users get fucked for a year
Is out of their control. They're not responsible for Keepass.com. That's both simple and obvious.
Apparently, if they put up some kind of banner on their website it'd be all cool and dandy?
Do you feel the same about uBlock Origin?
Let's get this straight. That uBlock Origin warns users that ublock.org is fake is a service. They do not owe you that service. They owe you two things: jack and squat.
You sound like you're entitled, but I ask you again: what did you contribute to make the problem go away? Did you donate money to the problem? Did you contact the project?
You talk about how users should do their own research, yet nobody at Keepass could even be bothered to update their homepage to help users make the disambiguation. Has Keepass done anything about this over the last year?
Keepass' last release was 8 days ago. What even is the point of pushing another commit until you've at least done the bare minimum to help your users? What even is the bedrock purpose of this software at that point? Isn't the goal a password manager to help good folks avoid getting pwned by bad guys in the first place? Yet they now have zero skin in the game when bad guys use their image to pwn their own users?
I just see bizarre incongruence. Like working hard to ship releases because that's the dedication your users deserve, gosh darnit, while your website has been compromised and serving different binaries for years.
To some degree, agreed. To some degree, this is the way the world works and protecting them earlier increases the risk that they'll make a big mistake later.
Potayto, potahto. The underlying system is still so messed up that safety here is literally impossible, and there's no alternative.
I touched a hot (wood) stove when I was a kid by the way.
To suggest that inability to do anything—or even indifference, as you characterize your argument in a later comment—implies they’re “in on it” is simply illogical.
There’s no evidence of KeePass developers being involved here, and it’s quite unlikely that they are. Short of using their own money—thousands of dollars—to hire a lawyer, there’s not much they can do.
Rebranding doesn’t really make sense. People are going to keep searching for and suggesting KeePass for a long time after the rebrand. It’s too established for them to pull that off; they’d end up driving even more people into the hands of malicious actors. When people search for KeePass, being unaware of the rebrand, they’ll inevitably stumble upon nefarious websites purporting to be KeePass. It just amplifies the problem.
An acknowledgement of the situation on the official site would be nice, though.
Nothing can replace common sense and critical thinking when installing software from the internet. In the end, everything on the internet is potentially untrusted and blindly looking for ".com" is just a dumb strategy if your goal is not to get pwned.
I really cannot bring myself to consider not acquiring <software_name>.com a failure of the software package creator. As I said, if they are aware of a currently on-going phishing attempt that is masquerading as their own software, a prominent tip on their actual website would be nice.
The namespace is finite and not every website can be expected to be under .com. Also, the trustworthiness of a TLD is itself a fad, a fashion that changes over time. See: the popularity of .io.