Data Security

https://arstechnica.com/security/2017/06/onelogin-data-breach-compromised-decrypted/ Another one bites the dust ☺️

Hi there, i start using Enpass and its great, but found some shortcoming here and there, so willing to give feedback. 1. Copied data through browser extension ( chrome extension) does not auto clear as it works inside Enpass main desktop application. 2. While generating a new password, there is one option only i.e. "Fill and copy" and as is said in my first point, data don't get auto cleared, so its a problem, as you know clipboard is not a safe place for sensitive data. I don't prefer copy-paste data when we are dealing with sensitive data. Instead of this, there should be a "Fill only" option to inject password directly without using clipboard and this will b…

I have just started using enpass and I love it, mostly because of its compatibility with Windows Hello facial recognition. Now I noticed that, when facial recognition does not work, you are able to log in using your Windows Hello PIN. I can imagine this undermines security quite a bit, since my PIN is much easier to break than my master password. So would it not be better to ask for the master password, whenever facial recognition is failing?

Keylogger Hello, When I write my main password in Enpass, is it protected against a keylogger?

Elmsoft Enpass Hello What's the Enpass opinion on this article : https://blog.elcomsoft.com/2017/08/one-password-to-rule-them-all-breaking-into-1password-keepass-lastpass-and-dashlane/ where those people claim they can easily break many of the master passwords. Despite Enpass was not tested but known competitors to Enpass (1Password, LastPass, Dashlane etc.) , some results appear just SOOO critical..... it would be good to have Enpass's opinion (as well as an ElcomSoft test on Enpass). Kind regards, Francesco

So Enpass is an offline password manager. But if you decide to sync your data, you have to use the cloud because you can't use Wi-Fi sync. I have to store my container on services like iCloud or Google, Dropbox if I want to access it from all my devices. Enpass is missing a 2FA. If somebody is able to access my cloud or hack the service I‘m using, he can steal my container. Enpass only offers a master password and nothing else. It can be hacked more easy than having a second factor. Any plans on adding such a feature in the future?

I've been playing around with the HxD editor today, and it has a nice built in feature that lets you view the memory of another process. This gave me the idea to check whether Enpass was exposing your sensitive information in memory. I opened up the running Enpass process in HxD, and did a simple string search for one of my passwords. Surprisingly, I was able to find multiple occurrences of my password stored as a raw string in memory, even while Enpass was locked (without PIN enabled). I was also able to find secure notes, usernames, TOTPs, and other sensitive information that I was not even accessing in the Enpass window. I tried finding many different entries, and one …

hello, I use KeePass at work, and from today I can't open my KeePass DB, "error Failed to load the specified file! The composite key is invalid!" Is there chance enpass db might become corrupted the same way?

Dear, Enpass developers. It's almost three months since I first started using Enpass, and by far, it's the most hidden gem of password managing services. Unfortunately, I have something terrible to report.... Lately, I'd been using this app frequently on Windows 10 and Android 5.1 (Marshmallow). It did a good job integrating with the cloud (I was using Google Drive) so I could view and edit items wherever I want. But then, something went wrong.... After I reinstalled it on my PC (OS reset) and reintegrated it back, there were about 3-4 login items that disappeared (it was last week). I already tried pressing sync multiple times on both devices but they just woul…

Hello, I just wanted to make a remark (with a little warning sign!) to you about the topic mentioned above: I've recently noticed, that the Enpass app on Android started showing a warning about my device being rooted and how this may cause security issues. As several popular Android apps recently seem to run some sort of campaign against rooted devices, I feel the need to say, that while I'm totally fine with a warning(!) like this, I could certainly not accept any kind of ban or extensive restrictions in functionality for rooted devices on part of Enpass. Should any of these ever occur, you will have lost me as a customer just this moment. So, if your warn…

Maybe it has already discussed but I try to understand why Enpass is more secure than "online" password manager. I need to sync my accounts to more than one device. So i decided to do that via WebDAV on my personal synology NAS system which is only reachable from the internet via VPN. But however, I think my home is not as secure as a data center like from amazon. So, if my nas gets stolen, it may be possible to get the encrypted database file with the passwords in a more easy way then to break into the data centers used by online password manager. The same is for backup on other external drives. So what is the real different? A hacker cannot login to my a…

Last week I had enpass running on 2 computers, (one Ipad and one laptop). Yesterday my laptop crashed spectacularly after Windows update, it was still under guarantee, so they straight away replaced it. However, my Enpass is still on there (along with everything else). I am currently changing all my passwords, but wondered if it is possible to stop access to Enpass from the old laptop when they eventually repair it. I have revoked access from the cloud, is that enough? Hoping someone can advise.

I don't know if password versioning actually qualifies as "Security" but it would definitely be a security for the all thumbs users we sometimes are. Password versioning would keep old passwords in case, on an all thumbs day, we copy something irrelevant in the password field, or if changing our password on an account fails and we still need our old password. Like file versioning, it would be configurable in number of versions kept, and/or in age of old versions. It would be combined with a recycle bin if we delete an entry by accident. From a security point of view, I don't believe password versioning poses any risk otherwise a password manager like Keepass wou…

I read the above thread and associated FAQ. But I haven't changed my password! So, make me wonder what is going. How could I get this message? Certainly, I how someone else has not fiddled with my signins, which I doubt, but still.) I use a Windows 10 laptop and a Windows 10 phone, both synced to OneDrive. So, how'd this happen? How do I fix it (same as above Oct 2, 2017 thread). Oh, I love Enpass!!!

I read the above thread and associated FAQ. But I haven't changed my password! So, I wonder what is going on. How could I get this message (see screen shot)? Certainly, I hope someone else has not fiddled with my signins, which I doubt, but still.) I use a Windows 10 laptop and a Windows 10 phone, both synced to OneDrive. So, how'd this happen? How do I fix it (same as above Oct 2, 2017 thread)? Oh, I love Enpass!!!

Hello there I'd like to share something very scary that happened to me a few days ago. I searched for Enpass on the Google Play Store and downloaded the app without checking it thoroughly. The app installed, and looked like Enpass, the only difference was the icon: instead of the usual keyhole in a blue circle, it looked like a pile of sheets with a keyhole in the middle. I launched it and it asked me whether I wanted to type in new data or restore previous data from the cloud. I chose to restore the data from Dropbox (I'm already using Enpass on other devices) and the app tried to connect with no success. It said it was impossible to connect and to try later. …

I have posted the post twice，please delete this post thank u

For now，all the discussion is about how impossible to crack the encryption files or the Master Password. I just want to know, if my PC have infected with a virus which can record my keyboard operation .It would be very insecure. What technical measures does Enpass have to prevent keyboard viruses? Can anyone answer this question for me ? Thanks a lot in advance！

How can I remove my profile from this forum software? I have no intention of using enpass, and I do not want to maintain an account here.

So I started using this today and have a couple of questions about syncing. 1) After setting it up to get it to sync to other things log in the service provider eg Dropbox, Google etc. Is there anything stopping someone who has access to my account from installing Enpass telling it to sync with my details, and getting all my passes? I don't think it will be a problem for me, as I did take measures if this is the case but am more curious. 2) Can I tell it what to sync to where? Basically I have 5-6 Important things I NEED on my phone in case I accidentally log out when not at my PC. But I intend to put everything on my PC version so I don't lose an ac…

My windows 10 system was overwhelmed by Temporary files and and i have less storage, so i decided to delete all those temporary files, as i read in this article https://youprogrammer.com/how-to-delete-temporary-files-windows-10-8-7/ that they can be deleted automatically everytime i boot into system, i am curious, is this gonna make any security issue to my windows 10 system, if i use this method to delete temporary files.

Hi ! Enpass looks nice. It's full of features. Of course, it makes me willing to use it. As I noticed for some software companies that spending time in developing features is a natural marketing constraint to catch more customers, it pushes security concerns to second priority. Then, I'd like to make my mind about and try to assess how good behaves your password generator ( that is one of the secure component that everybody can understand ) A simple test: measure the occurence of consecutive characters. with a simple setup (only numbers) : probability of having 2 consecutive number is below 1% for length=10 but statistics (I have tried …

Hi, You've described that the master password doesn't change from one device to another but need the new one for sync. Would you care to explain how do your encryption works? As @TroyHunt, security researcher, say on twitter and on hist website, I don't think it's a problem for you to say that since the technology is under public patent. So How does it work in your software ? How is it possible that we don't need to change the master password on the local device? Which algorithm do you use? If you are able to explain that, I think it would give more strenght to your brand image. best regards

Hi, I think that it would be important for us, customer, to understand what's your business model. As a security app, we should be able to know how would you work? So How can you make money on your app? Do you work like keepass, you have other jobs and do that as a side job (which is absolutely not a problem if there is not conflict of interest)? If you were a european company, 9 euros for only buy once the mobile app would be really not enough to survive for that big of a team. How can we trust a company that we don't know how do they make money? Especially with the problems with facebook etc. Any attempt to levitate this subject won't be very good for y…

Ich habe mir die ProVersion gekauft. Ich habe vom Windows 10 PC ein Backup gemacht und diese walletx Datei auf iCloud im Ordner Enpass gespeichert. Beim öffen der App am iPad kommt die Meldung: Leider konnten wir keine Enpass Daten auf Ihrem iCloud Account finden. Ich bin mit dem Internet verbunden und die Datei walletx befindet sich auch im diesen Ordner. Das gleiche Problem habe ich auch am iPhone. Ich habe es auch schon als neuer Benutzer versucht. Da schreibt er Synchronisationsfehler. Außerdem läßt sich am iPhone kein Update auf die ProVersion machen. Am Windos Pc habe ich alle Daten. Diesen PC habe ich aber nur benutzt um meine Daten von Keepass zu import…