I am doing some research on Password databases and apps recently. So fary, keepass seems to be the thing. I use it since years and it never failed me.
But having all in one, espechially if it works wirh my own nextcloud installation via web, seems to be a nice thing.
But I have some questions.
How are the Passwords stored? It does not look like an own “Container” or “Safe” like in Passman.
Are the entries stored in the SQLite/MySQL Database? How are they stored? What if someone gets his hands on my Database, is it possible to get the cleartext passwords?
As of right now (May 2018) Passwords does only offer server side encryption. This means that someone with access to the servers database and configuration can gain access to the passwords saved in the database.
A client side encryption based on libsodium and the web crypto api is under development right now and will be shipped in fall 2018. This will also include additional hardening for the server side encryption.
Note: It should be mentioned that even with client side encryption enabled, an attacker with access to your Nextcloud instance may be able to access your decrypted passwords by manipulating the web interface and stealing your database once it’s decrypted. This is a potential vulnerability for any web based password manager.
Passwords has a separate encryption key for every server, every user and every object revision (for passwords, folders and tags).
yes
Every password is stored as a set of revisions. See the object description. As mentioned above every revision is server side encrypted. Some meta data (user, id, changedate is stored unencrypted)
Currently yes.
As noted in my previous post, client side encryption will also not be a 100% secure way because an attacker with access to the server can manipulate the web interface of the app.
With the updates 2020.12.1 and 2021.1.0, the passwords app now provides client side encryption / end-to-end encryption for all users. This makes it next to impossible to get the decrypt the passwords in the database.
There are some limitations to the security of e2e that are still valid for any password manager, not just the passwords app:
Even with e2e your passwords are just as safe as the device you’re using it on. If someone can install some surveillance software on your device they can of course get all your passwords once you enter them somewhere. The good part about e2e here is that an attacker would have to do this for every user of the password manager and can’t just get all data from one convenient source.
For any passsword manager website/webinterface (Passwords/Passman,1Password… etc.), an attacker with access to the server or with access to an XSS security issue on that site could also add a script that steals your data when you log in. That can be prevented by using the apps or browser extension instead of the web ui.
For any password manager app or browser extension, an attacker with access to the developer accounts (eg. for the app stores), development environment, or build systems, an attacker could publish a modified version of the app that contains code to steal your data.
Open source software like the passwords app offers an advantage here since you can build the app yourself or verify the published source code. Our browser extensions for example ship with instructions to build that exact version from the source code.
Thanks for this update on the subject.
I did not find any options regarding the e2e encryption in the admin settings for the Passwords App.
Am I right to assume, that e2e encryption is enabled by default? (and for that matter can’t be turned off - not that I can imagine a reason I would want to)