5

I read on Keepass website that Keepass keeps password encrypted in the memory.

So is it secure to keep Keypass window open?

4
  • Unless someone can argue for why this specifically should be closed as not constructive, I'm going to assume that it could be answered with undisputable fact.
    – oKtosiTe
    Mar 31, 2013 at 12:18
  • I don't think it's a good idea. (At 2016), there are a few programs like KeeThief which can attach itself to KeePass and steal your passwords sourceforge.net/p/keepass/discussion/329220/thread/32cc71ec May 19, 2017 at 2:38
  • Also see Security and Reddit Dec 14, 2021 at 16:27
  • The question is incomplete: "...keep KeePass window open when ..." - what are the circumstances?
    – U. Windl
    May 11, 2023 at 12:17

4 Answers 4

4

Why don't you read the Keepass manual, and decide yourself?

Process Memory Protection

While KeePass is running, sensitive data (like the hash of the master key and entry passwords) is stored encrypted in process memory.

This means that even if you would dump the KeePass process memory to disk, you couldn't find the passwords.

For example, when you are copying a password to the clipboard, KeePass first decrypts the password field, copies it to the clipboard and immediately re-encrypts it using the random key.

Additionally, KeePass erases all security-critical memory when it's not needed anymore, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the password fields).

KeePass ≥ 1.15 and 2.x use the Windows DPAPI for in-memory encrypting the sensitive data. With DPAPI, the key for in-memory encryption is stored in a secure, non-swappable memory area managed by Windows. If DPAPI is not available or disabled (advanced KeePass options, by default using DPAPI is enabled), KeePass uses the ARC4 encryption algorithm with a random key. Note that this is less secure than DPAPI, mainly not because ARC4 cryptographically isn't that strong, but because the key for in-memory encryption is also stored in swappable process memory.

2

Well if you care about protecting your passwords enough to use keepass I wouldn't recommend it. Security is only as good as it's weakest link. Unless you are logged out and in a non-public place I wouldn't recommend it.

4
  • And the weakest link here is?
    – TFM
    Mar 30, 2013 at 15:59
  • 1
    Keeping the program up.
    – Griffin
    Mar 30, 2013 at 16:17
  • Wow, that was crystal clear.
    – TFM
    Mar 30, 2013 at 17:08
  • @TFM I know this is a little late (3 years) but I think I was referring to automated tasks being easier to perform. A quick off the top of my head example would be an automated task to copy the password to the clipboard paste it to a text file and send it to someone. Of course the machine has to be compromised in the first place but the only disadvantage I see to closing it is inconvenience.
    – Griffin
    Jul 14, 2016 at 13:41
2

Depends if anyone has access to your computer. Certainly if you lock your computer when you're not around, I don't see a problem.

0

Assuming there is malware on your device which tries to scan main memory for your sensitive data, the answer unfortunately is no.

Keepass provides some protection against this threat. It admittedly tries its best to protect your passwords (but not your user names etc.) in memory:

While KeePass is running, sensitive data is stored encryptedly in the process memory. This means that even if you would dump the KeePass process memory to disk, you could not find any sensitive data. For performance reasons, the process memory protection only applies to sensitive data; sensitive data here includes for instance the master key and entry passwords, but not user names, notes and file attachments. Note that this has nothing to do with the encryption of database files; in database files, all data (including user names, etc.) is encrypted.

Furthermore, KeePass erases all security-critical memory (if possible) when it is not needed anymore, i.e. it overwrites these memory areas before releasing them.

For some operations, KeePass must make sensitive data available unencryptedly in the process memory. For example, in order to show a password in the standard list view control provided by Windows, KeePass must supply the cell content (the password) as unencrypted string (unless hiding using asterisks is enabled). Operations that result in unencrypted data in the process memory include, but are not limited to: displaying data (not asterisks) in standard controls, searching data, replacing placeholders (during auto-type, drag&drop, copying to clipboard, ...), importing/exporting files (except KDBX) and loading/saving unencrypted files. Windows and .NET may make copies of the data (in the process memory) that cannot be erased by KeePass.

A 2019 study linked on Reddit (using KeePass 2.40) has demonstrated how passwords can be left in memory unencrypted. This applies only to passwords you have interacted with in the open session, and does not apply to the master password. Apparently, there is no difference in security regarding this issue with locked or unlocked state. (Obviously, locked state still prevents people from using your Keepass file if you leave your device unlocked and unattended.) They conclude:

End users should, as always, employ security best practices to limit exposure to adversarial activity, such as:

(...)

  • Shutting a password manager down completely when not in use even in a locked state (If using one that doesn’t properly sanitize secrets upon being placed into a locked running state)

However, there is only a threat if there is malware on your device. So, it could also be that the malware

  • steals your sensitive data in the few seconds you have Keepass opened.
  • is a keylogger. Though Keepass offers some protection against keyloggers, I am not sure whether it applies to the master password. If not, you could still use an additional master key file to mitigate this issue.

So the question remains open how much additional security the habit of always closing (not only locking!) Keepass as soon as possible really offers in practice.

As an idea for a tradeoff between security and convenience, you could use two Keepass files: One you close as soon as possible that you use for super-sensitive data like email logins, banking logins, crypto asset keys etc.; and another one you leave open for a long period of time that you use for less sensitive data like message board logins etc.

Disclaimer: I am not a security expert, only a professional software developer.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .