3

I am concerned about the possibility to download a fake keepass upgrade.

If possible this would allow many ways to get private data on keepass files!

For example, keepass hacked or modified code could send the kbdx file by ftp to a server in China or in Crimea! Or hacked keepass could send the kbdx file attached in email in a thank you note to keepass developers...

Is this possible?

user42765
  • 31
  • 1

1 Answers1

5

To reduce the risk you can

  1. double check the source of your download (webiste url, https etc)
  2. verify the download with his keyprint (provided by the author).

"KeePass can be downloaded from many mirror servers. If you want to check if the offered files are verified by the KeePass authors (i.e. official and original files), you can hash the downloaded file using the hash computation utility of your choice (you can try one of these utilities: Visual Hash Calculator, ReHash, MD5sums) and see if the hashes match."
http://keepass.info/integrity.html

On keepass.info download page you will find (at the bottom) the links to do that: Hash Sums Verifying your download: Hash Sums, OpenPGP Signatures, .NET Public Keys

xaa
  • 178
  • 1
  • 4