Ivarson

If you didn't enter your masterpassword, the passwords isn't readable, even if the wallet was downloaded and passed to a third party. You should probably check https://www.dropbox.com/account/security to review past events

Might I ask what the webDAV fix is about specifically? My wallet resides on self-hosted nextcloud

Is it possible to have Enpass launch a file using the OS default application for ut? Instead of an URL, I'd like to enter "file://C/temp/secret.zip" and just click it, instead of copying it.

Just remember that storing your first factor along with your second isn't conscidered good practise. The shared key for generating TOTPs is reversible to cleartext to (be able to sync ofc.). One could argue that its overkill to protect it further since its already within the vault which already is protected. But still, having your one-factor vault compromised would result in breach for your two-factor logins, if stored together :-)

There already is? Add a field to existing item and choose TOTP

I did step 1 the first time (wiping data +cache) which didn't help. When I tried reinstalling again it seems to work without any further actions. What differs is that might had multiple db-files in /data last time since I switched from Google to dav-sync (and the sync-db seems to be left when switching provider) OR its related to that I changed master password in Android app prior to reinstall. None of this applied to the reinstall today which went smoothly. Thanks for you great work and effort!

I removed the current beta version (via androids uninstall feature /dragndrop icon to trashcan on nova launcher) and reinstalled the beta from Play store. Upon launching enpass for the first time I wasn't facing the first time slides, but an Master Password screen, where my password wasn't valid. I uninstalled from Play store and installed once again with the same result. After leaving beta program, the stable version of enpass behaved correctly and gave me the first time slides and I was then able to restore my backup and get up and running. Just FYI.

https://arstechnica.com/security/2017/06/onelogin-data-breach-compromised-decrypted/ Another one bites the dust ☺️

Bug / workaround. When I launch Enpassportable.exe I get "LIBEAY32.DLL missing" and main window won't launch. Second time I launch the same exe however the message won't appear and main window launches. LIBEAY32.dll was there and valid. When I renamed from using lowercase to uppercase the error went away completely. Windows 10 1703. Portable beta 5.5.4

Nice update, i especially like that you got rid of the "browse"-dialogue if one choose to remember last path. Too bad we can't opt out from update- tracking- and analytics-mechanisms like on Desktop Beta 5.5.4 though. I'll probably stick with the "installed" version and just let my wallet reside on a removable drive.

Today when I launched Enpass latest beta) on my pc running Windows 10 Creators update, Enpass showed me the welcome dialog all of a sudden. New user or restore existing database. My wallet resides on a removable drive, having only a mount point, not a drive letter. I immediately checked that the drive was mounted at the expected path and that it was accessible. I relaunched Enpass but still the dialog appeared. As soon as I hit restore database, the wallet and its sync copy vanished from the USB drive. No harm done since I've got cloud backup but I don't get why it didn't recognized the existing database. The registry key for changedlocation was present and correct in hkcu.

Just wanted to get a hint on how everybody else is using Enpass and at the same time show my setup. I use an USB-wristband for portability. I've got one layer of bitlocker using aes128 autounlock with tpm) and within that the walletx with its own aes256. Instead of the Enpass Portable I've got Enpass desktop installed on my three PCs pointing to an USB drive. That way I split up meta settings for Enpass in the registry and vault on a removable drive. Also when frequently synchronizing, the performance is better when executables that aren't secret reside on a local drive. I use cloud sync, so local backup isn't necessary. I only mount the USB stick and vault when required, and never run Enpass in the background. Critical secrets like Google or Microsoft are not stored in the vault, only their TOTP.

Of course, maybe i was a bit misleading. The point is that Enpass doesn't do security validation on the URLs you're doing autofill on. That's part of the reason the devs require the user to hit autofill via the hotkey or plugin-button. The security has to lie in you, your OS and the browswer. Like when you visit your home router at "192.168.x.1" which of course isnt even an dnsname. At best, you've got a self-signed certificate which the browser hopefully warns you about, That does encrypt the traffic but doesnt ensure the identity of the router. Enpass doesn't care though, neither should it imho.

Spoofing a site to Enpass should be easy, because it's not built to_verify_ the identity of a host, only to filter out a match that's as accurate as possible . Always check the certificate and hostname before using autofill.

Some suggestions for the mobile apps: Scan barcodes/QRs. generate those codes back as an fullscren-image, to show in the store etc. Scan NFC-tags. Export secret to another NFC-host? wouldn't that be a cool offline-way to share a secret with someone? In Android, Let Enpass be a target in "Share to"-menu for textstrings and numbers. Themes, c'mon.. light/dark atleast, you did it in the UWP-app ;-) in Android Wear-app, if only one field is shown on watch, increase that one textstring and center it, like you do on TOTP when shown on wear-app.

This is the reason why there's a much read thread regarding security audit in this very section. :-)

@Hemant Kumar great news indeed! Thanks!

Good stuff. Now when attachments can be added to a record, it would be nice being able to search for attachments and sort results by size, if I quickly want to reduce the size on the wallet by removing the biggest attachment.

Agree. The fact that sync is available for free too makes it very usable. I'd really like to see some report of an security-audit though but I don't doubt the devs when they say it's pricy... The common Enpass-user probably buys the mobile app for their corresponding plattform, which is about the same price as a 1-year subscription for other products.. I did actually buy the Windows Store-app mostly to support Enpass, the product doesn't replace the desktop version and it doesn't really offer that much functionality other than Windows Hello-support, but i feel like i support the team in both economic ways and by supplying feedback for additional plattforms..

I think much of it depends on her skills with IT and whether she'll use enpass in daily life. If she's totally green on computers in general you wouldn't have her to worry about a relatively small software to work on a specific device/OS the day you pass on. Maybe store stuff in enpass and do regular export-printouts to paper and lock those in a safe? If she's into IT like you though (but just not custom to keep records of passwords) then sure go ahead keeping them digitalized and encrypted. As you said yourself, maybe static information like bankaccounts and insurance-docs doesn't need to roam over devices like logins tend to do with syncing. Other then enpass, there's of course a multitude of software for this. What if you want to store some scanned documents in pdf format, or other pictures or files in the "wallet"? Enpass is not a filecontainer in that sense, it's a database/record-oriented solution which on the other hand makes cataloging, syncing and searching easy and less error-prone . A software like VeraCrypt (derivate of TrueCrypt) lets you store anything inside it and is also cross-platform and available as portable edition. With VeraCrypt you can also require a specific file to be available to open the vault. So theoretically you can store that key-file in a usbdrive (and wear it around your neck or lock it in) , telling her that file is needed to access the main-vault.

My 2 cents... That is an essential question. Colocation of sensitive information into one place with added security is generally what you do with most your secrets or valuables such as passwords, creditcards (in the wallet) or money (the bank :-)) The main-problem today is that passwords as a single authentication-challenge is too vague. Too often, theyre not properly protected at the site storing them. As a quantifier, we often re-use them, so gaining access to an email + password at a website many times gives access to 10 other sites,. A password manager sorta moves the issue from having one password stored at 100 locations into having it stored at 1 (with a master password). The issue isnt entirely solved, but at least you've compensated for those forums that didn't ran security updates since 2014 and are affected by heartbleed, poodle and whatnot. So you wont need to panic about public password-dumps like those on Flashback.org and immediately visit https://haveibeenpwned.com/ What I like about Enpass is; I can place these secrets whereever I want, at any disk, any site, cloud, removable media etc, Im not bound to store them where "thieves" start looking. Im not forced to bundle 100% of my credentials in ONE wallet-file. I can choose to place some less-sensitive secrets in one wallet which I sync, and other critical stuff in an ofline location like a removable drive or a disc which isnt even mounted other than when I actually need it. Having that said, there's LOTS of factors that come into play. Is the Master Password a sufficent challange to access all my stuff, or do I require another factor (2FA)? A peek over your shoulder is enough for someone to gain access to all stuff, if gaining access to the wallet. A keyboard-logger can easily be snuck into the back of a workstation, Heck, KeySweeper doesnt even require physical connection to your computer to intercept keystrokes from a wireless Microsoft-keyboard. Storing a second authentication factor ALONG with the first one in the same place generally beats the purpose, at least partially, Use wisely. What are the consequences if my wallet gets compromized? can I recover or will my life be over? (e.g I never store the credentials for my primary email anywhere, since that in the wrong hands with "forgot my password" would result in access to any accound, theoretically. Many people today stare themselves blind on the level of encryption, "Oh its AES-256, that's militarygrade so its safe, Period, the competitor is just using 128-bits!". Sure the enc. implementation is of esssence, but its not "period". A simple comparision-instruction could potentially be swapped by a skilled rev. engineer to set security aside, (im not implying anything specific to Enpass here)Im just saying that often, security mechanisms aren't broken brute-force, they're simply bypassed, Do I NEED to store the PIN for my creditcard in a passwordmanager? I remember it just fine prior to using any pwdmanager, so why should I store it outside my head? IMHO, there's simply a balance between security and usability, between wisdom and stupidity. but its individual Sorry for the.. hefty content,

Mail sent (for participation in Swedish translation)

The Edge plugin roadmap can be followed here https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/extensions/api-support/extension-api-roadmap/ No plans for loopback connectivity, but an "consideration" to be able to download files programmatically via plugin. Maybe the plugin could perform all necessary operation itself directly on the wallet? Either from original wallet file or network share as given the option in Sync options, or one downloaded from a cloud provider, fetched by the plugin itself. Having the plugin performing updates to the wallet such as changing password records might be overkill, one could do that stuff in native clients having it immediately synced by the plugin. Would be neat to hear the devs view on this.

Not the same, no. Although the differences are indeed being smoothed out with clientside hashing/encryption for lastpass etc. But when using Enpass, even if I use Google Drive, I can rest asure that its just being used as a "dump transport-service", that is, Google never has a clue of the content of the file, but I can be assured that the file is available since the stability of Google's service in general. (i did use a local owncloud-instance first, but it felt overkill to dedicate a virtual owncloud-machine solely to a wallet-file for enpass :-) One thing which indeed is intruging, maybe thats what you meant in the first Place. Wouldn't it be possible for devs here to write an Edge plugin, with the ability to open a wallet directly from a cloud-provider? That is, an Edge-plugin which pretty much acts like a complete Enpass-client itself. In that case, I as an Win10 user and UWP-app customer, would only need the UWP app and the Edge app, not the desktop version.

Read above. Edge, along with its UWP platform does its best to isolate apps from reaching other apps or processes running on the same machine (loopback). for security concerns mainly. Lastpass and others have their users connect to their cloud to access secrets, hence no loopback communication, so no issue with Network Isolation in UWP