LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 05-03-2020, 06:55 AM   #1
czezz
Member
 
Registered: Nov 2004
Distribution: Slackware/Solaris
Posts: 924

Rep: Reputation: 43
keepass vs keepassXC


Does anyone know what is the advantage of keepassxc over regular keepass?

Keepass seems to be audited in the European Commission's Free and Open Source Software Auditing (EU-FOSSA 1) whereas keepassxc has been not.

However my second thought is that maybe this information is to mislead people and make them mistakenly thinking it is safe software to keep passwords but in fact it has hidden backdoors?

I know, quite paranoid but I wonder if anyone already did some research about that?
 
Old 05-03-2020, 08:13 AM   #2
ntubski
Senior Member
 
Registered: Nov 2005
Distribution: Debian, Arch
Posts: 3,781

Rep: Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081
https://keepassxc.org/docs/#faq-keepass

Quote:
Q: Why KeePassXC instead of KeePass?

A: KeePass is a very proven and feature-rich password manager and there is nothing fundamentally wrong with it. However, it is written in C# and therefore requires Microsoft's .NET platform. On systems other than Windows, you can run KeePass using the Mono runtime libraries, but you won't get the native look and feel which you are used to.
KeePassXC, on the other hand, is developed in C++ and runs natively on all platforms giving you the best-possible platform integration.
 
Old 05-03-2020, 08:18 AM   #3
czezz
Member
 
Registered: Nov 2004
Distribution: Slackware/Solaris
Posts: 924

Original Poster
Rep: Reputation: 43
I dont see how does it refer to security and trust.
Possibly I wasnt clear in my initial post. By advantage I mean security and reliability... not the outlook (look and feel).
 
Old 05-03-2020, 12:10 PM   #4
ntubski
Senior Member
 
Registered: Nov 2005
Distribution: Debian, Arch
Posts: 3,781

Rep: Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081Reputation: 2081
Quote:
Originally Posted by czezz View Post
By advantage I mean security and reliability... not the outlook (look and feel).
In that case, it seems clear from what the keepassXC developers themselves wrote: there is no security or reliability advantage to keepassXC over keepass. If there was, surely they would have mentioned it.
 
Old 05-03-2020, 12:31 PM   #5
uteck
Senior Member
 
Registered: Oct 2003
Location: Elgin,IL,USA
Distribution: Ubuntu based stuff for the most part
Posts: 1,173

Rep: Reputation: 501Reputation: 501Reputation: 501Reputation: 501Reputation: 501Reputation: 501
If you are worried about security and trust for your password manager, may want to look at Bitwarden. Open source and has been audited.
 
Old 05-03-2020, 06:09 PM   #6
czezz
Member
 
Registered: Nov 2004
Distribution: Slackware/Solaris
Posts: 924

Original Poster
Rep: Reputation: 43
By a quick look it seems Bitwarden is cloud-based. Means u store your sensitive data at the 3rd party organization.
Im surprised anyone would even consider it as a place to store a password and call it safe.

Last edited by czezz; 05-03-2020 at 06:24 PM.
 
Old 05-03-2020, 06:27 PM   #7
uteck
Senior Member
 
Registered: Oct 2003
Location: Elgin,IL,USA
Distribution: Ubuntu based stuff for the most part
Posts: 1,173

Rep: Reputation: 501Reputation: 501Reputation: 501Reputation: 501Reputation: 501Reputation: 501
Bitwarden has a server build you can host yourself it you don;t trust the cloud.
https://bitwarden.com/help/article/w...ust-bitwarden/
https://bitwarden.com/help/article/install-on-premise/
 
Old 05-03-2020, 08:18 PM   #8
frankbell
LQ Guru
 
Registered: Jan 2006
Location: Virginia, USA
Distribution: Slackware, Ubuntu MATE, Mageia, and whatever VMs I happen to be playing with
Posts: 19,324
Blog Entries: 28

Rep: Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142Reputation: 6142
The advantage of Keepassx over Keepass, at least initially, was that Keepass did not offer a Linux-compatible version. I could not find a Linux version for download at the Keepass website, although the Wikipedia article says that they offer Linux support via mono.

Here's the Keepass?? digest:

Keepass was designed for Windows and Mac.

KeepassX is an opensource program with compatibility for Keepass v.1 database formats. I did not check to see whether it has been upgraded to have compatibility with the Keepass v. 2.0 database format.

Keepassxc started as a community fork of Keepassx implementing compatibility with the Keepass v.2 database format.

I have used both Keepassx and Keepassxc and have no complaints about either.
 
Old 05-06-2020, 04:34 AM   #9
ondoho
LQ Addict
 
Registered: Dec 2013
Posts: 19,872
Blog Entries: 12

Rep: Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053Reputation: 6053
Quote:
Originally Posted by czezz View Post
Does anyone know what is the advantage of keepassxc over regular keepass?

Keepass seems to be audited in the European Commission's Free and Open Source Software Auditing (EU-FOSSA 1) whereas keepassxc has been not.

However my second thought is that maybe this information is to mislead people and make them mistakenly thinking it is safe software to keep passwords but in fact it has hidden backdoors?

I know, quite paranoid but I wonder if anyone already did some research about that?
This question has been asked & answered several times across the 'net.
Obviously you saw some of that, otherwise you wouldn't know about one having the security audit while the other didn't.
First of all, the mere existence of a security audit does not say anything about the software's security, and that goes both ways:
  • software that did get an official audit is not necessarily secure.
  • software that did not get an official audit is not necessarily insecure.
But more importantly, security audits are most relevant for internet-facing applications, esp. when they store sensitive data online. I suspect keepass has such feature (never tried it) but keepassxc does not! Therefore keepassxc is the safer and better alternative for me, apart from hating mono applications (it's not only the looks, they're also sluggish and mono tends to be more buggy than native toolkits).

Quote:
Originally Posted by uteck View Post
Bitwarden has a server build you can host yourself it you don;t trust the cloud.
Well then it's your own cloud! Still needs to be secure.

Last edited by ondoho; 05-06-2020 at 04:36 AM.
 
1 members found this post helpful.
Old 06-08-2020, 04:27 PM   #10
czezz
Member
 
Registered: Nov 2004
Distribution: Slackware/Solaris
Posts: 924

Original Poster
Rep: Reputation: 43
What I eventually did is:
I keep KeePass (the one with allegedly audited code) inside of VM without the network AND guest OS without network stack.
That is another layer of assurance that data will not leak.

I know, quite paranoid but safe
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Free Password Manager KeePassXC 2.5.0 Adds Paper Backup, Re-Enables Wayland Support LXer Syndicated Linux News 0 10-29-2019 09:39 PM
keepass-issues: added entries to keepass - but login to this pages not possible ! - Why is this so? sayhello_to_the_world General 12 10-31-2016 01:20 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 09:25 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration