How do you protect hostnames in DNS? My thoughts are to whitelist machine that can query reverse DNS, like normal users querying PTR 10.10.10.53 may get public.server.local but not secret.server.local.

@JohnZhau Split Horizon DNS

Also just don't allow reverse queries

@OakDEV What are the parameters?

Can't remember on top of my head but the main was AES-Twofish / 64 char pwd

Can I verify these configs (buffers and such) afterwards?

Sure

AES 256 / Argon2d / Transform 6 / 300 MiB (mem-use) / Parallelism 3 threads

3 threads?

Why?

Followed a thing

From a place

Paralellism should be the number of cores you have

Affects on security being?

I changed it.

@MechMK1 No direct effects on security?

@OakDEV This is the effect on security

Fair point.

Silly me.

Just to give you an idea

I get it. but go on

With my settings all staying the same and parallelsm turn to 8, calculating the argon2 hash takes 1.5 seconds

If I turn it to 3, it takes almost twice as long

So with parallelism 3, I would have to reduce the number of iterations significantly to get 1.5 seconds execution time

What's the total execution time?

Acknowledged.

Does this appear when unlocking

or should I find it somewhere else?

(using the benchmark thing?)

1 second

I will see where it is in KeepassXC

Sorry

Open up your database

Yep

Then in the menu select Database > Database Security...

yep

alrdy there

On the left menu "Security"

Yep

encryption settings

In the tab "Encryption settings"

yep

then on the bottom Advanced settings

... ?

Well, now you put in your parallelism and memory values

Then benchmark 1.0s will tell you how many iterations you will need for 1 second

And you can extrapolate from there

Keepass (the original) also has a "test" button

But that's too Old-School for KeepassXC

I'm at 14

So 10

should be optimal

and get 1.5s?

Why?

No, more iterations!

Right!

22

So this is solely for the speed/time for the encryption key to be in-use

?

It means an attacker with the same hardware as you will take 1.5 seconds per key derivation

Instead of, say 1.000.000 hashes per second

Oh. I thought that time was the possible vuln time for an attacker with direct access to PC could intercept or something

that makes more sense

higher = better

Yes, higher = better, but also more uncomfortable

Shouldnt I put it at 100?

I mean... even if it takes 10 seconds

I dont mind

my password takes 10 seconds to type

If you don't mind, crank that bitch up high

lez gooooo

It will just become insanely annoying if you mistype

One question at a time

What do you mean with "How safe is that file?"

KBPX

Which file, and safe from what?

You mean your Keepass database?

Yes

kpbsxs

kpbxs

bpksd

x

Is it as safe as a WPA/TKIP or something

I assume not.

I've never heard of any issues with it.

Those two things are complete opposites

and it's the default passmgr for a couple very reputable SEC-OS

It's like saying "Is Keepass as safe as a car"

@MechMK1 I know it's half a joke.

WPA literally goes in the air

as encrypted waves

and some other stuff that I don't have the time to remember

So does WEP, and that's not secure either

I know.

Have you ever heard of the term "threat model"?

It was a loose example

@MechMK1 If by that you mean: overflows/bruteforces/xss/...

I've seen it a couple of times.

A threat model basically means "What are you trying to protect yourself from? And how are you going to achieve that?"

For example, a password manager will protect you from password reuse and easily cracked passwords. It won't protect you from a guy storming your house with a gun

Oh. Yes. My passwords taxidermies and categorization were made based on threat models

Let's look at disclosure of the database. We don't know how, but an attacker got a copy of you KeepassXC database file. What can they do now?

Well, for one, they can use a side channel attack and analyze the size of the database. While this won't be 100% accurate, it can allow an attacker to guess some things, such as whether or not I have attached documents to the database or not

This is something we cannot realistically prevent, and just something you have to live with

From a threat actor, probably with federal juristiction and possibly with no knock warrant

Being able to decrypt

Everyone who steals your database is a threat actor

Which is why I'm specifying attributes

so get a dozen 1MB random files, and attach to the database...

@ThoriumBR Even if you did, you could still not hide the fact that something is attached

but that's the idea

I cannot have a database that has documents attached and make it look like it has no documents attached

We're straying away from the real question. Is there any publicly known exploits that could threaten a kbpx file

No but who cares

having dozens of files with high entropy so an attacker does not know which ones are encrypted versions of useful data, and which aren't

I can do the reverse: Have a database with no documents attached, but make it look like it has documents attached

@ThoriumBR The whole DB is encrypted

It's just one fat binary blob

The question just is, is it a big blob or a small blob

@OakDEV No, you could just google that

this is the first level... if someone manages to get the key, they get the second level full of nothing and spend a lot of time bruteforcing nothing

@ThoriumBR If your database master key is leaked you're already fucked

It's game over

it's like having a ssh daemon on port 22 that does not accept any passwords

@MechMK1 or you use 12345678 as a mater database, and only put lots and lots of fake logins and random files inside, and let that leak

*master database password

@ThoriumBR That doesn't really stop anyone

no, but makes people spend time chasing the wind

Depends on how convincing the attacker is

A dude holding a shotgun to your wife's head has quite a convincing argument

No password manager will protect you there

"look, I got this keepass database full of credentials, and they have some encrypted files inside... the passwords for them must be in the database, I only have to find the correct parameters... it must be a symmetric key, and they must have the key on the database"

Also your task as defender isn't really to "waste the attackers time", at least not directly

@MechMK1 this is outside my threat model

@ThoriumBR Mine too, because i have no wife and don't care if I die

I mean, sure, you can make a honeypot, but a good attacker can see you never access that file

and i don't have anything that anyone would try to kill someone to get

KeepassXC keeps a record of which files have been accessed most recently

@MechMK1 usually the "attacker" is a random malware that scans the computer after juicy files and uploads them...

@ThoriumBR Don't say that. I've seen people get killed over change

@ThoriumBR As I said, you can if you want. You could also just create an uncrackable file

@MechMK1 sure... I've seem a guy here killing another on cold blood because he was turning 18 in 3 days and had not killed anyone yet, so he did because as soon as you turn 18, all your criminal record is deleted...

Where the AES key doesn't match the Argon2 key

@ThoriumBR Ah yes, obviously

@MechMK1 My point exactly. My issue spawns from me keeping my DB into well known affiliates of NSA/Prism/etc...

OneDrive

Google Drive etc

@ThoriumBR Wow, I have a strange feeling you come from a GTA server

at 18 all your record are erased?

bro come in this alley real quick?

wanna show you something

@MechMK1 Now that I'm a bit reassured about the DB, should I jump to my next question on your opinion on the security-os thing?

depending on the crime, you get on a youth jail for at most 3 years. after leaving, you have a clean criminal record, no matter what you did before turning 18

a guy here was 17, and was the leader of a gang that hijacked a couple that was camping, raped the girl for days after shooting her boyfriend and letting him die from shock after 3 days, killed her after a week, and got caught later. he got convicted and was to be in jail for 3 years, got released before that, and now is free without any criminal record at all. news outlets cannot even use his real name or picture "for reasons"

so the drug dealers here use minors as soldiers, spies, delivery boys, hitmen... because they cannot be in prison

so cops give the boys a beating, and have to release them

That's so fucked up...

Why does this law stays the same if it's so much abused?

Because its convenient for the powers that be?

I'm damn sure that people in power profit from the crimes some way or other

because people defending rights have a pretty strong lobby on the congress

if someone wants to change that, those people scream "he wants to put kids in jail for cheating on high school exams!"

@ThoriumBR Question: are those the same people the ones who later use those kids for crimes?

and nobody wants to be seem as "the guy who wants to throw babies in jail"

@nobody no, usually not. usually they are people without kids and think kids cannot be evil

and think some 12 yo can decide that he wants to be a she, but a 17 year old does not know that killing someone after beating that someone for a week is wrong...

The thing is, you are no longer really a kid after I think 13 or 14

You can have all the capabilities of an adult except experience