this post was submitted on 20 Jun 2023
15 points (100.0% liked)
Free and Open Source Software
17772 readers
49 users here now
If it's free and open source and it's also software, it can be discussed here. Subcommunity of Technology.
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
These really aren’t vulnerabilities. Give the github issue a read. Basically, if they have access to the unencrypted db, then asking for the password again is just window dressing. It doesn’t really provide much, if any security value as they already have the data from the db.
Keepassxc is not an online manager. It doesn’t really make sense to require a password when making changes as they already have access to everything if they have local access to the machine when the db is unlocked.
It's a denial of service vulnerability. Requiring the existing master password to change the master password will stop a drive by miscreant denying you access to your db. And password change system I've ever used has required the existing password to he entered first.
Likewise a full db export feel like a big enough deal to require authorization.
If you're careful and lock your machine when you leave it then you should be pretty safe. I'm surprised these aren't already features.
No, requiring the existing master password won't help. A drive by miscreant with access to an unlocked computer with an unlocked DB can delete all the DB entries. If the DB is locked they can just delete the DB file. KeePassXC can't defend against this, that takes properly functioning versioned backups.
yeah, maybe denial of service isn't it. I replied to a comment above why I think it should still be protected functionality to help prevent data leak.
They could just delete the file to deny you access to your db?
Yeah, that's fair. But a full db export that they could then email themselves. It'd be nice to have some more protection against that. Or Change the master password and email the encrypted file to themselves.