<story><title>KeePassXC Debian maintainer has removed all network features</title><url>https://fosstodon.org/@keepassxc/112417353193348720</url></story><parent_chain><item><author>theamk</author><text>Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes &amp;#x2F; exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1].&lt;p&gt;Remember, the full network-enabled package is present in debian as well - so all the network features are &amp;quot;apt install keepassxc-full&amp;quot; away, for users that want it.&lt;p&gt;Two minor comments: calling your upstream &amp;quot;crappy&amp;quot;[0] is probably not the most productive way for package maintainer to act. Also, I am not sure if the package names (keepassxc vs keepassxc-full) are best for Debian users - something like keepassxc-lite and keepassxc-full might be more informative.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#issuecomment-2104401817&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#iss...&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#issuecomment-2104512907&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#iss...&lt;/a&gt;</text></item></parent_chain><comment><author>arp242</author><text>Lots of things are a huge potential hole and&amp;#x2F;or exploit entry point. Lots of these things are also useful.&lt;p&gt;And &amp;quot;being useful&amp;quot; can &lt;i&gt;increase&lt;/i&gt; security because if password managers are hard to use then people stop using them.&lt;p&gt;And looking at this a bit more, it&amp;#x27;s not clear to me that using the clipboard is necessarily more secure than the browser integration. Copy&amp;#x2F;paste accidents alone would offset quite a bit of the security footprint of a browser integration.&lt;p&gt;Many years ago I did some contracting for a fairly large company.[1] The laptops of their account managers had a disk encryption passwords, Windows login password, and AD login password. They all had to be different. They all had to be changed every few months. They all had &amp;quot;must contain at least two capitals, at least 4 non-letter&amp;#x2F;digits, and at least one 11 digit prime number&amp;quot;-type requirements.&lt;p&gt;Every single laptop I ever saw had a post-it note with all three passwords. Without exception.&lt;p&gt;My point here is: hypothetical security nerd security does not equal actual real-world security. Or at least not always. There are real trade-offs to be made here.&lt;p&gt;[1]: We did some maintenance of the laptops as an external contractor for some of the guys. They weren&amp;#x27;t really supposed to, but it was tons faster and easier because less bureaucracy, as doing it by their own IT system took forever. It was that type of company. This, on its own, was of course also a &amp;quot;security risk&amp;quot; because random tech guys from a computer store shouldn&amp;#x27;t really be on their laptops with super-secret company data (I don&amp;#x27;t think there wasn&amp;#x27;t that much to protect, other than sales&amp;#x2F;customer numbers which is only useful for a very select group of people).</text></comment>
<story><title>KeePassXC Debian maintainer has removed all network features</title><url>https://fosstodon.org/@keepassxc/112417353193348720</url></story><parent_chain><item><author>theamk</author><text>Looks like pretty reasonable decision to me - network features and browser integrations are huge potential holes &amp;#x2F; exploit entry points. And without network-related features and only running the trusted databases, the tool should be impossible to exploit even if exploits are found, which is a very desirable trait for something as important as password manager. Even original maintainer agrees [1].&lt;p&gt;Remember, the full network-enabled package is present in debian as well - so all the network features are &amp;quot;apt install keepassxc-full&amp;quot; away, for users that want it.&lt;p&gt;Two minor comments: calling your upstream &amp;quot;crappy&amp;quot;[0] is probably not the most productive way for package maintainer to act. Also, I am not sure if the package names (keepassxc vs keepassxc-full) are best for Debian users - something like keepassxc-lite and keepassxc-full might be more informative.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#issuecomment-2104401817&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#iss...&lt;/a&gt;&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#issuecomment-2104512907&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;keepassxreboot&amp;#x2F;keepassxc&amp;#x2F;issues&amp;#x2F;10725#iss...&lt;/a&gt;</text></item></parent_chain><comment><author>Arnavion</author><text>There&amp;#x27;s one way in which browser integration improves security vs not using it, which is that the browser extension checks the page URL before filling in the credentials, while the approach of manually copy-pasting credentials is vulnerable to typo- and homoglyph-phishing.</text></comment>