Team KeePassXC / is on Nostr

KeePassXC is a modern, secure, and open-source password manager that stores and manages your most sensitive information.

You can run KeePassXC on Windows, macOS, and Linux systems. KeePassXC saves many different types of information, such as usernames, passwords, URLs, attachments, and notes in an offline, encrypted file that can be stored in any location, including private and public cloud solutions.

Team email PGP key: 105D 8D57 BB97 46BD

Last Notes

2024-05-13 16:57:11

- reply

@npub14s5…v0vk This is not for those spreading misinformation, it’s for those receiving it without knowing the context.

2024-05-13 15:51:59

Following the recent discussion around the Debian decision to ship KeePassXC without any of its optional modules, we've seen some extreme misconceptions floating around the internet regarding what the WITH_XC_NETWORKING=OFF compile flag actually does.
Let us be clear: KeePassXC does NOT "randomly" connect to the internet in the background, regardless of whether you build with the flag on or off. Claims to the contrary of KeePassXC "surfing in the background" or "calling home" are false.
1/4

2024-05-13 15:51:59

- reply

KeePassXC connects with the internet in only three situations:
1) to check for updates (we ask you first if you agree it and this feature is disabled in downstream packages such as Debian's anyway)
2) when you manually click the button to download a website's favicon on the Edit Entry form
3) when you decide to check your credentials against the online Hibp service (again, by explicitly clicking a button).
2/4

2024-05-13 15:51:59

- reply

That's it. That's all that is removed from your build when you disable the flag. There is no web server running or anything, it's only client code requiring a manual action that is removed (as well as a link dependency to OpenSSL, which may be more significant).
3/4

2024-05-13 15:51:59

- reply

What this flag DOES NOT do is sandbox KeePassXC in any way. It will also not remove Qt's internal networking modules, since these are still required for certain offline functionality such as URL parsing and local sockets (blame Qt for not separating this functionality). It will also not prevent a local attacker from loading other DLLs/SOs/DYLIBs containing network code at runtime.
4/4