Ivarson

I did step 1 the first time (wiping data +cache) which didn't help. When I tried reinstalling again it seems to work without any further actions. What differs is that might had multiple db-files in /data last time since I switched from Google to dav-sync (and the sync-db seems to be left when switching provider) OR its related to that I changed master password in Android app prior to reinstall. None of this applied to the reinstall today which went smoothly. Thanks for you great work and effort!

I removed the current beta version (via androids uninstall feature /dragndrop icon to trashcan on nova launcher) and reinstalled the beta from Play store. Upon launching enpass for the first time I wasn't facing the first time slides, but an Master Password screen, where my password wasn't valid. I uninstalled from Play store and installed once again with the same result. After leaving beta program, the stable version of enpass behaved correctly and gave me the first time slides and I was then able to restore my backup and get up and running. Just FYI.

https://arstechnica.com/security/2017/06/onelogin-data-breach-compromised-decrypted/ Another one bites the dust ☺️

Bug / workaround. When I launch Enpassportable.exe I get "LIBEAY32.DLL missing" and main window won't launch. Second time I launch the same exe however the message won't appear and main window launches. LIBEAY32.dll was there and valid. When I renamed from using lowercase to uppercase the error went away completely. Windows 10 1703. Portable beta 5.5.4

Nice update, i especially like that you got rid of the "browse"-dialogue if one choose to remember last path. Too bad we can't opt out from update- tracking- and analytics-mechanisms like on Desktop Beta 5.5.4 though. I'll probably stick with the "installed" version and just let my wallet reside on a removable drive.

Today when I launched Enpass latest beta) on my pc running Windows 10 Creators update, Enpass showed me the welcome dialog all of a sudden. New user or restore existing database. My wallet resides on a removable drive, having only a mount point, not a drive letter. I immediately checked that the drive was mounted at the expected path and that it was accessible. I relaunched Enpass but still the dialog appeared. As soon as I hit restore database, the wallet and its sync copy vanished from the USB drive. No harm done since I've got cloud backup but I don't get why it didn't recognized the existing database. The registry key for changedlocation was present and correct in hkcu.

Just wanted to get a hint on how everybody else is using Enpass and at the same time show my setup. I use an USB-wristband for portability. I've got one layer of bitlocker using aes128 autounlock with tpm) and within that the walletx with its own aes256. Instead of the Enpass Portable I've got Enpass desktop installed on my three PCs pointing to an USB drive. That way I split up meta settings for Enpass in the registry and vault on a removable drive. Also when frequently synchronizing, the performance is better when executables that aren't secret reside on a local drive. I use cloud sync, so local backup isn't necessary. I only mount the USB stick and vault when required, and never run Enpass in the background. Critical secrets like Google or Microsoft are not stored in the vault, only their TOTP.

Of course, maybe i was a bit misleading. The point is that Enpass doesn't do security validation on the URLs you're doing autofill on. That's part of the reason the devs require the user to hit autofill via the hotkey or plugin-button. The security has to lie in you, your OS and the browswer. Like when you visit your home router at "192.168.x.1" which of course isnt even an dnsname. At best, you've got a self-signed certificate which the browser hopefully warns you about, That does encrypt the traffic but doesnt ensure the identity of the router. Enpass doesn't care though, neither should it imho.

Spoofing a site to Enpass should be easy, because it's not built to_verify_ the identity of a host, only to filter out a match that's as accurate as possible . Always check the certificate and hostname before using autofill.

Some suggestions for the mobile apps: Scan barcodes/QRs. generate those codes back as an fullscren-image, to show in the store etc. Scan NFC-tags. Export secret to another NFC-host? wouldn't that be a cool offline-way to share a secret with someone? In Android, Let Enpass be a target in "Share to"-menu for textstrings and numbers. Themes, c'mon.. light/dark atleast, you did it in the UWP-app ;-) in Android Wear-app, if only one field is shown on watch, increase that one textstring and center it, like you do on TOTP when shown on wear-app.

This is the reason why there's a much read thread regarding security audit in this very section. :-)

@Hemant Kumar great news indeed! Thanks!

Good stuff. Now when attachments can be added to a record, it would be nice being able to search for attachments and sort results by size, if I quickly want to reduce the size on the wallet by removing the biggest attachment.

Agree. The fact that sync is available for free too makes it very usable. I'd really like to see some report of an security-audit though but I don't doubt the devs when they say it's pricy... The common Enpass-user probably buys the mobile app for their corresponding plattform, which is about the same price as a 1-year subscription for other products.. I did actually buy the Windows Store-app mostly to support Enpass, the product doesn't replace the desktop version and it doesn't really offer that much functionality other than Windows Hello-support, but i feel like i support the team in both economic ways and by supplying feedback for additional plattforms..

I think much of it depends on her skills with IT and whether she'll use enpass in daily life. If she's totally green on computers in general you wouldn't have her to worry about a relatively small software to work on a specific device/OS the day you pass on. Maybe store stuff in enpass and do regular export-printouts to paper and lock those in a safe? If she's into IT like you though (but just not custom to keep records of passwords) then sure go ahead keeping them digitalized and encrypted. As you said yourself, maybe static information like bankaccounts and insurance-docs doesn't need to roam over devices like logins tend to do with syncing. Other then enpass, there's of course a multitude of software for this. What if you want to store some scanned documents in pdf format, or other pictures or files in the "wallet"? Enpass is not a filecontainer in that sense, it's a database/record-oriented solution which on the other hand makes cataloging, syncing and searching easy and less error-prone . A software like VeraCrypt (derivate of TrueCrypt) lets you store anything inside it and is also cross-platform and available as portable edition. With VeraCrypt you can also require a specific file to be available to open the vault. So theoretically you can store that key-file in a usbdrive (and wear it around your neck or lock it in) , telling her that file is needed to access the main-vault.