2fa.directory API

[Timkwh]

Hi,

I figured out you are using 2fa.dirctory api for checking if 2fa is available.
Unfortunately they are listed as malicious and also they load content from to tdsjsext1.life which also is malicious.
Can you remove or change this API? Or give User an option do disable this API?

Best Regards,
Tim

[Timkwh]

Sorry, just found the option to disable.

[Rookiestyle]

Actually I'm loading not the website but a vey specific json file (https://2fa.directory/api/v2/tfa.json) and I'm sure that this will not load any other code from any additional website.

Nevertheless I might think about looking for alternatives. Where are they listed as malicious?

[DonEstefan]

Where are they listed as malicious?

Hi @Rookiestyle. The URL 2fa.directory was marked as "suspicous" by several security vendors over the time (see https://www.virustotal.com/gui/domain/www.2fa.directory). I also know of Checkpoint Products, which block the site even today.

I would kindly ask you to disable the feature by default, as it is likely to rise alarms in corporate environments. Also the concept of an password manager plugin connecting to internet without prior user consent is likely cause mistrust - even when done with good intentions.

[Rookiestyle]

Where are they listed as malicious?

Hi @Rookiestyle. The URL 2fa.directory was marked as "suspicous" by several security vendors over the time (see https://www.virustotal.com/gui/domain/www.2fa.directory). I also know of Checkpoint Products, which block the site even today.

Thanks for the hint.
Virustotal does not seem to update these ratings on a regular basis.
As of today, 2 out of 87 vendors flagged 2fa.directory as suspicious (potential phising) and all 87 ratings are 9 months old

I would kindly ask you to disable the feature by default, as it is likely to rise alarms in corporate environments.

I don't get this point.
In corporate environments, I expect KeePass to be installed by your IT department - including a well-defined set of plugins that might include KeePasOTP.
If this is the case, this single URL can be whitelisted as well. It's even possible to redirect it from 2fa.directory to any other location.
You should not be able to install software yourself (no admin rights, no access to programs folder, ...) and you should not be able to put plugins into your company-managed KeePass installation either

If you download and run the portable version on your company's device, from my point of view alerts are justified - not so much because of 2fa.directory but simply because it's programs accessing the internet which were not installed by your IT department.

Also the concept of an password manager plugin connecting to internet without prior user consent is likely cause mistrust - even when done with good intentions.

Point taken.
This is already visible in the screenshots shown in the readme and I agree: It should at least be mentioned explicitly.

I updated the readme to make this clear and the next release will explicitly ask whether this feature shall be used.
I won't disable it by default as I consider the additional benefit of getting this information more valuable.

[DonEstefan]

In corporate environments, I expect ...

While this holds true in a perfect world, I know many companies/customers that need to deal with a less than perfect reality. Convincing them them to stop storing passwords in excel is much more difficult, when the password manager causes alerts in their brand new antivirus 🤪
Anyways, thanks a lot for your consideration and the changes in the next release. It's much appreciated!