Full Thread: Privacy
View Single Post
Old February 20th, 2013 #6
Ed in CT
Good Guy
 
Ed in CT's Avatar
 
Join Date: Aug 2007
Posts: 490
Default

A password manager that encrypts your password database and you secure it with one master password. Free, open source software.

http://keepass.info/

Quote:
KeePass supports the Advanced Encryption Standard (AES, Rijndael) and the Twofish algorithm to encrypt its password databases. Both of these ciphers are regarded as being very secure. AES e.g. became effective as a U.S. Federal government standard and is approved by the National Security Agency (NSA) for top secret information.

The complete database is encrypted, not only the password fields. So, your user names, notes, etc. are encrypted, too.
SHA-256 is used as password hash. SHA-256 is a 256-bit cryptographically secure one-way hash function. Your master password is hashed using this algorithm and its output is used as key for the encryption algorithms.
In contrast to many other hashing algorithms, no attacks are known yet against SHA-256.

Protection against dictionary and guessing attacks: by transforming the final master key very often, dictionary and guessing attacks can be made harder.
In-Memory Passwords Protection: Your passwords are encrypted while KeePass is running, so even when the operating system caches the KeePass process to disk, this wouldn't reveal your passwords anyway.

[2.x] Protected In-Memory Streams: When loading the inner XML format, passwords are encrypted using a session key.

Security-Enhanced Password Edit Controls: KeePass is the first password manager that features security-enhanced password edit controls. None of the available password edit control spies work against these controls. The passwords entered in those controls aren't even visible in the process memory of KeePass.

The master key dialog can be shown on a secure desktop, on which almost no keylogger works. Auto-Type can be protected against keyloggers, too.
Also see the security information page.