

KeePass – weak on Android (and it's Android's fault) - marco1

If you&#x27;re using KeePass on Android, you&#x27;re most probably syncing your database via Dropbox, Google Drive, any other cloud service, or even some P2P sharing.<p>Whatever you&#x27;re doing, there is a severe weakness in security that&#x27;s due to Android.<p>An attacker could just operate as follows:<p>1. They build an app that has both the &quot;&quot; and the &quot;&quot; permission (most apps have that already)<p>2. As the external storage is publicly readable, they can just scan it for <i>.kdb and </i>.kdbx files<p>3. Any such files that have been found can be collected by the malicious app<p>4. (Optionally, the collected files could be encrypted locally by the malicious app)<p>5. The files can then be sent to a remote server in the background, without you ever noticing<p>6. Having a free app with millions of downloads is not <i>that</i> hard (and you could even buy one on eBay)<p>7. With millions of users, you may collect thousands of KeePass databases (stored on your remote server) that you can try to decrypt patiently
======
throwaway9997
Why are you keeping password files on shared storage? Android's internal
storage mechanism allows you to save files that are only readable from your
application using Linux's user permissions model.

This looks like a PEBKAC rather than Android problem.

~~~
marco1
No, it's actually KeePass for Android that doesn't give you any other way to
do this.

You can't store your files in the app-private directories yourself without
rooting your device. KeePass just asks for a path to a password file, so you
have to put it on shared storage.

Obviously, the problem is foremost a KeePass problem, secondarily an Android
problem, and least PEBKAC.

