KeeWeb Security: Is it still safe to use Keeweb in 2023?

[howdytom]

Happy New Year!

Since there has been no development and the project is on hold and probably EOL - What about the KeeWebs security? Is it still safe to use KeeWeb for Mac/Windows in 2023?

Any replies are highly appreciated.

[jivarson]

Id say the core is safe, but the dependencies could be vulnerable. If there's a risk it would be a sideloading-attack or such on the clientside. If you're worried, you should switch to KeePassXC which i compatible. You have to sync the database yourself though.

I think theres bigger risk that stuff like signing-certs or syncronization and stuf fthat requires active maintance will stop work first.. or OS-compat to be outdated.

[howdytom]

I absolutely agree and I was expecting this kind of answer. This is exactly why I use Keewebs core only, without any dependencies which is already inconvenient. Thank you. I really appreciate your reply.

[strazto]

Though the dependencies could be vulnerable, you do have the option of forking it and then running dependabot against your fork, merging whatever dependabot flags, then building from there.

Overall, that should be a reasonably low effort way to mitigate supply chain vulns.

A fork that just comprises SCA automations & releases would be amazing to see.

I do think it's unfortunate that the project is no longer maintained, and #2022 hasn't seemed to gain any apparent traction, whether that's due to a lack of applicants, or a lack of quality applicants, or a lack of time to actually handover to the new maintainer.

Related:

Can anyone suggest a good Windows client alternative?
I use Keepass2Android on my phone, and it's excellent.

On MacOS I would probably turn to Strongbox (I don't mind their pricing model), same for iPhone if I had an iPhone.

The only gap is Windows - I'd be happy enough to keep using keeweb, (especially via a fork that includes SCA mitigations) but I wonder if there's a maintained alternative that has a more "native" UX.

[strazto]

In fact, I've gone ahead and soft-forked this & enabled dependabot, I'll respond to merge requests by dependabot and try to publish releases whenever I do that.

https://github.com/strazto/keeweb

[thefiredragon]

@strazto will you also do some releases next time ?

[strazto]

Oh lol dependable is actually annoying as hell so I got distracted, I'll have another crack

[tzeumer]

In fact, I've gone ahead and soft-forked this & enabled dependabot, I'll respond to merge requests by dependabot and try to publish releases whenever I do that.

https://github.com/strazto/keeweb

I was checking the status of #2022 and just by chance also saw this ticket. Now I'm wondering if instead of a fork this branch could be maintained (even if only for these dependency updates). 🙃

[HarlemSquirrel]

I offered to help maintain like a year ago or more but got no response. I'm not in the EU so maybe that's why.

[HarlemSquirrel]

@strazto I just found this which looks promissing: https://github.com/OneKeePass/desktop

Although, it seems limited at the moment with no Dropbox integration and it doesn't like my existing db when I tried to load it just now 😢

The database file is an older version Kdbx 2 or Kdbx 3 formatted file. This is not supported by OneKeePass. Only Keepass 2 database with KDBX format version 4.x is supported

[Aetherinox]

v1.19 will fix any vulnerabilities that existed in older packages that are currently in-use. The beta version right now is using mostly updated packages, aside from Electron, which got a slight bump, but we need to re-organize the framework in order to update Electron any further.

I went through the list of known vulnerabilities before I began updating, and most of them are related to a compromised development environment, or users who have their own system compromised. And obviously the developer environment vulnerabilities won't affect the end-user unless you're building your own release of KeeWeb.

As long as your system itself isn't compromised; you should have no issues maintaining a secure KeepWeb database.

• v1.19 Updates #2168

[strazto]

Good to see the project has picked up new maintainership.

Thank you for addressing this @Aetherinox