Ivarson

Is it possible to have Enpass launch a file using the OS default application for ut? Instead of an URL, I'd like to enter "file://C/temp/secret.zip" and just click it, instead of copying it.

Just remember that storing your first factor along with your second isn't conscidered good practise. The shared key for generating TOTPs is reversible to cleartext to (be able to sync ofc.). One could argue that its overkill to protect it further since its already within the vault which already is protected. But still, having your one-factor vault compromised would result in breach for your two-factor logins, if stored together :-)

There already is? Add a field to existing item and choose TOTP

I did step 1 the first time (wiping data +cache) which didn't help. When I tried reinstalling again it seems to work without any further actions. What differs is that might had multiple db-files in /data last time since I switched from Google to dav-sync (and the sync-db seems to be left when switching provider) OR its related to that I changed master password in Android app prior to reinstall. None of this applied to the reinstall today which went smoothly. Thanks for you great work and effort!

I removed the current beta version (via androids uninstall feature /dragndrop icon to trashcan on nova launcher) and reinstalled the beta from Play store. Upon launching enpass for the first time I wasn't facing the first time slides, but an Master Password screen, where my password wasn't valid. I uninstalled from Play store and installed once again with the same result. After leaving beta program, the stable version of enpass behaved correctly and gave me the first time slides and I was then able to restore my backup and get up and running. Just FYI.

https://arstechnica.com/security/2017/06/onelogin-data-breach-compromised-decrypted/ Another one bites the dust ☺️

Bug / workaround. When I launch Enpassportable.exe I get "LIBEAY32.DLL missing" and main window won't launch. Second time I launch the same exe however the message won't appear and main window launches. LIBEAY32.dll was there and valid. When I renamed from using lowercase to uppercase the error went away completely. Windows 10 1703. Portable beta 5.5.4

Nice update, i especially like that you got rid of the "browse"-dialogue if one choose to remember last path. Too bad we can't opt out from update- tracking- and analytics-mechanisms like on Desktop Beta 5.5.4 though. I'll probably stick with the "installed" version and just let my wallet reside on a removable drive.

Today when I launched Enpass latest beta) on my pc running Windows 10 Creators update, Enpass showed me the welcome dialog all of a sudden. New user or restore existing database. My wallet resides on a removable drive, having only a mount point, not a drive letter. I immediately checked that the drive was mounted at the expected path and that it was accessible. I relaunched Enpass but still the dialog appeared. As soon as I hit restore database, the wallet and its sync copy vanished from the USB drive. No harm done since I've got cloud backup but I don't get why it didn't recognized the existing database. The registry key for changedlocation was present and correct in hkcu.

Just wanted to get a hint on how everybody else is using Enpass and at the same time show my setup. I use an USB-wristband for portability. I've got one layer of bitlocker using aes128 autounlock with tpm) and within that the walletx with its own aes256. Instead of the Enpass Portable I've got Enpass desktop installed on my three PCs pointing to an USB drive. That way I split up meta settings for Enpass in the registry and vault on a removable drive. Also when frequently synchronizing, the performance is better when executables that aren't secret reside on a local drive. I use cloud sync, so local backup isn't necessary. I only mount the USB stick and vault when required, and never run Enpass in the background. Critical secrets like Google or Microsoft are not stored in the vault, only their TOTP.

Of course, maybe i was a bit misleading. The point is that Enpass doesn't do security validation on the URLs you're doing autofill on. That's part of the reason the devs require the user to hit autofill via the hotkey or plugin-button. The security has to lie in you, your OS and the browswer. Like when you visit your home router at "192.168.x.1" which of course isnt even an dnsname. At best, you've got a self-signed certificate which the browser hopefully warns you about, That does encrypt the traffic but doesnt ensure the identity of the router. Enpass doesn't care though, neither should it imho.

Spoofing a site to Enpass should be easy, because it's not built to_verify_ the identity of a host, only to filter out a match that's as accurate as possible . Always check the certificate and hostname before using autofill.

Some suggestions for the mobile apps: Scan barcodes/QRs. generate those codes back as an fullscren-image, to show in the store etc. Scan NFC-tags. Export secret to another NFC-host? wouldn't that be a cool offline-way to share a secret with someone? In Android, Let Enpass be a target in "Share to"-menu for textstrings and numbers. Themes, c'mon.. light/dark atleast, you did it in the UWP-app ;-) in Android Wear-app, if only one field is shown on watch, increase that one textstring and center it, like you do on TOTP when shown on wear-app.

This is the reason why there's a much read thread regarding security audit in this very section. :-)

@Hemant Kumar great news indeed! Thanks!