A fresh new look should [...]]]> A revamped tutorial has just been switched on. The fundamental principles highlighted in the tutorial have not been significantly changed but the process should now be more streamlined. Additionally, new users are now encouraged to complete at least the first three steps of the tutorial (instead of four).

A fresh new look should help everyone to concentrate on the important messages and familiarise themselves with KeeFox more quickly.

What do you think? How could it be improved in future? Are there any concepts missing that should be added into the tutorial?

A link to the tutorial is displayed after Keefox is successfully set up and can also be found in the KeeFox main menu (help / getting started).

I hope to release a new version in 4-6 weeks with a beta available within a few weeks. In the mean time, the existing version of KeeFox will continue to work with KeePass 2.17. As with the previous [...]]]> Thanks to everyone that notified me of the problems with the recently released version of KeePass.

I hope to release a new version in 4-6 weeks with a beta available within a few weeks. In the mean time, the existing version of KeeFox will continue to work with KeePass 2.17. As with the previous problematic KeePass upgrade, your upgrade route will be much simplified if you continue using KeePass 2.17 until after you are running a new version of KeeFox*. There are currently no known security problems with KeePass 2.17 that necessitate an immediate upgrade.

This time there were many changes to KeePass that prevented KeeFox from working. I was notified of at least some of these changes in advance of the release of KeePass 2.18 but did not have a development environment to work and test with until after the official release last week.

I have identified a way to get KeeFox to work with 2.18 and most users shouldn’t notice any differences but in light of the following major changes to the KeeFox code I have decided to push the fix to existing users quite cautiously – there’s no point in risking breaking KeeFox for everyone just so that some people can run the very latest version of KeePass.

For anyone interested, the two major changes to the KeeFox code are:
1) I’ve upgraded (and then customised) the Jayrock JSON-RPC server bundled within KeePassRPC
2) I’ve set .NET 4 as the default runtime for KeeFox users who don’t yet have a copy of .NET installed

This work required an upgrade to Visual Studio 2010 and I took that opportunity to make a clean break from the existing SVN revision control at Sourceforge; KeeFox code is now available on github, details will be announced in the coming weeks.

* Or at least downgrade to 2.17 before installing the new version of KeeFox.

This version supports KeePass 2.17 (and earlier). There are a few other improvements too – full details are in the release notes for version 0.9.3a on this page: https://addons.mozilla.org/en-US/firefox/addon/keefox/versions/

I recommend installing the updated version of KeeFox while still [...]]]> A new version of KeeFox has just been approved on the official Firefox add-ons site.

This version supports KeePass 2.17 (and earlier). There are a few other improvements too – full details are in the release notes for version 0.9.3a on this page: https://addons.mozilla.org/en-US/firefox/addon/keefox/versions/

I recommend installing the updated version of KeeFox while still running version 2.16 (or earlier) of KeePass. If you have already upgraded to KeePass 2.17 you will need to “paste and go” this URL in your location bar and click “Upgrade KeeFox”:
chrome://keefox/content/install.xul?upgrade=1

A change was made to KeePass in version 2.17 which means that KeeFox 0.9.2 and earlier no longer work. Specifically, the KeePassRPC KeePass plugin no longer loads (it gives an error message saying it is incompatible with the new version of KeePass). This sort of plugin incompatibility issue was supposed to have been eliminated with the new “plgx” plugin format but there are evidently still a few edge cases that can cause a problem and KeeFox was the unlucky plugin this time around.

Dominik (the main developer of KeePass) has kindly agreed to try to give me advance notice of future KeePass releases so emergency fixes like this can be developed before the new KeePass version is made publicly available. Neither me nor Dominik can make any promises but we think the 2.17 upgrade problems are atypical of past and future KeePass upgrades.

Special thanks have to go to the addons.mozilla.org team (particularly Jorge Villalobos) for fast tracking this new version through their thorough and often lengthy review processes!

Sorry for any confusion or inconvenience this may have caused you.

NB: A few bits of text are “NOT TRANSLATED” for non-English users – they shouldn’t be crucial to understanding the add-on and will be replaced with correct translated versions as soon as possible. Sorry, this decision was the lesser of two evils!

It will be great if we can increase the number of translations over the [...]]]> KeeFox is now ready for an international audience with translations into non-English languages. Incomplete Swedish and Russian translations are available in version 0.9 but complete versions have already been submitted ready for the version 0.9.1 release, along with Chinese (Simplified).

It will be great if we can increase the number of translations over the next few weeks so that version 0.9.1 can be understood by as many people as possible. If you (or anyone you know) are willing to contribute to the translation of KeeFox into other languages please register on Babelzilla and follow the simple instructions they provide.

See:
Babelzilla
The KeeFox section on Babelzilla
KeeFox thread on the Babelzilla Discussion forum (please direct all translation related queries here)

Note that there is currently no way to modify the text of the KeePassRPC plugin. If anyone has any time to implement a suitable localisation system for KeePass PLGX plugins I’m sure it will be appreciated by many KeePass plugin authors. I’m thinking maybe a seperate plugin or patch for KeePass that allows runtime modification of strings; it would be good if PLGX compilation were not a requirement for translators. Please post any further thoughts or offers of help in the main KeeFox forum or KeePass forum (depending on how specific your comment or solution is).

Users already subscribed to the development channel (i.e. running 0.8.22b at the moment) will be upgraded automatically.

You can easily swap back to 0.8.21 if you find a problem with 0.9 so please try it out and post in the forum [...]]]>

You can now download version 0.9b from the development channel at https://addons.mozilla.org/en-US/firefox/addon/keefox/

Users already subscribed to the development channel (i.e. running 0.8.22b at the moment) will be upgraded automatically.

You can easily swap back to 0.8.21 if you find a problem with 0.9 so please try it out and post in the forum if you do find any new issues.

Assuming a successful beta testing period, this version will be rolled out to all 0.8.21 users in a couple of weeks.

This version is suitable for widespread use but may still contain a few bugs.

This version has a few improvements to the features added in 0.8.22, updates the default version of KeePass to 2.16 and adds the first two (incomplete) translations:

• Swedish
• Russian

The previously unannounced version 0.8.22 also changes:

• FIXED: Editing passwords with KeePassRPC GUI sometimes showed an empty password
• Master key entry dialog focuses correctly on all versions of Windows (most of the time)
• Improved form filling for some types of form

Note that earlier versions of Firefox 6 had a bug which prevented KeeFox from working. FF6b3+ should work fine, as should Firefox 7a*.

A full record of changes is available in the changelog as usual: http://keefox.svn.sourceforge.net/viewvc/keefox/trunk/Firefox%20addon/CHANGELOG.txt

Before releasing version 1.0 I will improve documentation / help, add as many translations as possible and of course fix any bugs that I can.

This is a required upgrade for all users. You must upgrade before the end of June 2011 or KeeFox will stop working. Firefox should automatically prompt you to install a new version soon and future versions of KeeFox will keep up to date automatically through the [...]]]> You can now download version 0.8.21 from https://addons.mozilla.org/en-US/firefox/addon/keefox/

This is a required upgrade for all users. You must upgrade before the end of June 2011 or KeeFox will stop working. Firefox should automatically prompt you to install a new version soon and future versions of KeeFox will keep up to date automatically through the official Firefox add-ons site.

Apart from the switch to an automatic update system, there are a few other minor improvements too. Full details are available in the changelog as usual: http://keefox.svn.sourceforge.net/viewvc/keefox/trunk/Firefox%20addon/CHANGELOG.txt

After the 30th of June 2011 versions of KeeFox previously downloaded from this website will cease to function so you will need to install the version from the Firefox add-ons directory [...]]]> I’m pleased to announce that KeeFox has recently been accepted into the official Firefox add-ons directory and can now be found at https://addons.mozilla.org/en-US/firefox/addon/keefox/

After the 30th of June 2011 versions of KeeFox previously downloaded from this website will cease to function so you will need to install the version from the Firefox add-ons directory sometime in the next month. This expiry time is simply to ensure that no-one gets stuck using potentially insecure old versions of KeeFox; all future updates will be delivered automatically in the same way as most Firefox add-ons you have installed (so a fixed expiry time is no longer required).

Version 0.8.20 is currently available and can be installed from the Mozilla add-ons website even if you have already installed version 0.8.20 from this website. Since future updates will be installed automatically it shouldn’t make a big difference whether you install KeeFox from https://addons.mozilla.org/en-US/firefox/addon/keefox/ now or when the next update is announced.

Note that this does not change the beta status of KeeFox. I still think it is nearly ready for an official “1.0″ release and the Mozilla add-ons review team think that it is “good enough” to be included in the official directory but there is still work to be done, especially with respect to documentation.

There may still be a few bugs here and there but I think the long list of improvements since version 0.8.10 warrants a release now.

There have been over 15 bug fixes along with some new features, the most notable being:

Sorry for the inconvenience.

This version now works with websites that have HTML5 form elements, has more accurate HTTP Auth dialog entry matching, handles protected password fields correctly and works with password database paths that contain Unicode characters.

Please could all experimental version users upgrade to this version becuase:

1) [...]]]> Another release candidate candidate is available for download.

This version now works with websites that have HTML5 form elements, has more accurate HTTP Auth dialog entry matching, handles protected password fields correctly and works with password database paths that contain Unicode characters.

Please could all experimental version users upgrade to this version becuase:

1) You might not know if your form filling accuracy is affected by some of the bugs fixed in 0.8.17

2) It will help give me confidence to release 0.8.17 to the wider group of KeeFox users and stop having to write “release candidate candidate”

Please let me know what you think of the latest version!

The other improvements since 0.8.12 [...]]]> A new experimental version is available at http://keefox.org/download/experimental-version. There are a couple of important bug fixes including one where some other parts of Firefox stopped working when KeeFox was installed so I recommend all users of 0.8.12-14 should upgrade. Users of 0.8.10 should not be affected by this bug.

The other improvements since 0.8.12 are:

• Improved password field matching
• HTTP Auth dialogs now respect global and site-specific “offer to save passwords” settings

KeeFox is now “feature complete” as far as version 1.0 is concerned – there are still many features I want to add later in the year but for the [...]]]> This new version is a release candidate candidate. Please help to test it so that I do not have to say that too many times!

KeeFox is now “feature complete” as far as version 1.0 is concerned – there are still many features I want to add later in the year but for the next few months I will be concentrating on fixing bugs and ensuring that the documentation and help resources are up to scratch before the release of version 1.0. There may still be the occasional new feature but only if it’s a low-risk with a high benefit to the “average” user. Further details on future releases with new features will follow in the coming months but in the mean time please help me test this version so that I can have confidence in its suitability for a final release and hence get started on the “post 1.0″ feature requests as soon as possible.

Key changes in this release (since 0.8.10) are:

• HTTP Auth dialogs now prompt to save passwords
• A few other HTTP Auth dialog improvements
• Setup process displays a warning to close KeePass if an existing KeePass installation is detected on the PC
• A few improvements to the insert process of KeeFox sample entries
• Improvements to the detection of which form fields should be filled in with which bits of KeePass data
• Fixed: older “Alternative URLs” did not always appear in the “URLs” tab in the “edit entry” KeePass entry tab
• Improvement to detection of matching entries: hostname matching is now case-insensitive

It requires and includes KeePassRPC version 0.8.9 so hopefully a standard upgrade through Firefox will do the trick but if you do have problems, please delete the KeePassRPC plugin from the KeePass plugins folder. There also may be an issue with the release candidate [...]]]> Version 0.8.8 is now re-released on the experimental download page.

It requires and includes KeePassRPC version 0.8.9 so hopefully a standard upgrade through Firefox will do the trick but if you do have problems, please delete the KeePassRPC plugin from the KeePass plugins folder. There also may be an issue with the release candidate of Firefox 4 which means that you should wait until Firefox has started before opening KeePass to trigger the start of the upgrade procedure – I’ll investigate that more in a few days and release a fixed version if necessary.

PS: If you’re interested, the problem with the initial upload was that I forgot to include a tiny icon in the KeePassRPC.plgx package.

This one has several new features and some important bug fixes and improvements to existing features. Please upgrade if you’re running an experimental version at the moment; I hope to release this as a final beta version before Firefox 4 is officially released (a couple of weeks?) [...]]]> Here’s another experimental version for your enjoyment.

This one has several new features and some important bug fixes and improvements to existing features. Please upgrade if you’re running an experimental version at the moment; I hope to release this as a final beta version before Firefox 4 is officially released (a couple of weeks?) so all feedback can help me judge whether that is a good idea or not!

Highlights of this release are:

• Fixed: Auto-submit on HTTP Auth dialogs no longer closes the parent window (often closing Firefox as a result)
• Fixed: “monitor[ing] each web page for new forms” no longer causes a “flashing” effect on the toolbar
• Changing options no longer requires a restart of Firefox
• KeePass entry dialog editor KeeFox tab is now split into three sub-tabs to make it less cramped
• Improvements to the handling of locations: a new location manager and the ability to set different home groups for different locations via the “edit group” KeePass feature
• Improved detection of the “best” password when multiple entries exist for the same domain
• More complete list of matched logins on pages with matches in more than one frame
• Improvements to the installer including: no longer overwriting KeePass with the bundled version when manually setting the KeePass location
• HTTP Auth improvements (now uses the “realm” to improve auto-fill/submit accuracy and adds a tooltip showing the entry title)

This version adds several new features, fixes a few bugs and improves support for Firefox 4. Highlights include:

The “edit entry” and “edit group” dialogs in KeePass now have a new “KeeFox” tab [...]]]> The latest experimental build is now available from the experimental download page. As usual, this has been only briefly tested so expect the occasional bug. This time around there are quite a few new features including the following highlights.

The “edit entry” and “edit group” dialogs in KeePass now have a new “KeeFox” tab which allows point and click control of many advanced features and options that were previously only available through manual configuration of “advanced strings”. Features such as matching alternative URLs and fine control over auto-fill and auto-submit behaviour are just a couple of examples; A picture speaks a thousand words so here are some screenshots:

This feature is fairly large in scope and I’ve not yet been able to test every way it can be used so please report any bugs you find and speak up about any suggestions you have for future improvements in this area.

Logins can now be edited from the right-click / context menu on the matched login menu / button. Combined with the new entry editing tab in KeePass I think the process of refining KeePass entries to behave as you intend should be much more streamlined and accessible to more users.

Also, the “remember installation location” option was broken – now it’s fixed, which should help portable KeePass/Firefox users.

Last but not least, it should also more-or-less work in Firefox 4. The two main areas that still need work for Firefox 4 support are the setup wizard and HTTP authentication (and similar dialog boxes) but there are likely to be numerous other bugs. Therefore note that if you have trouble installing it into a fresh Firefox 4 profile, you may need to first install into a 3.6 profile and upgrade the profile by running Firefox 4 afterwards (or follow the manual installation guidelines).

Security concious people might view a KeePass remote access system with fear and loathing and it is true that installing this plugin exposes a new attack vector. I’ll [...]]]> Another technical post here which explains why KeePassRPC is secure and how an application developer needs to handle authentication with the plugin to protect its users.

Security concious people might view a KeePass remote access system with fear and loathing and it is true that installing this plugin exposes a new attack vector. I’ll explain how KeePassRPC can be exploited to access a user’s password database but you will see that the installation of the plugin is safe provided that…

A) Neither me nor any 3rd party developers of libraries used in this project have made a mistake in the plugin code

B) Both client and server machines remain secured from 3rd party threats such as viruses, trojans, keyloggers, etc.

The source code for this plugin is available for all to view – this is the best reassurance that you can get regarding point A; of course if any mistakes are discovered I would fix them as quickly as possible and announce the release of the new version straight away.

Point B is often a matter of contention among users looking for a high security password management system. An oft-repeated claim is that “product x protects against keyloggers” and while there is usually truth to this statement it is never a cast-iron guarantee of protection. There really is nothing that can be done to protect your data once any machine you use has been compromised – security software will protect you against the most common (usually generic) attacks but they are not the panacea they sometimes market themselves as.

With that in mind I will introduce the first way in which KeePassRPC protects a KeePass user’s data but first some background information is required.

After installing KeePassRPC, the KeePass executable will begin listening on a network port for requests from other applications that want to access the data inside KeePass. Currently this communication is limited to network traffic that stays within the local computer (aka localhost or 127.0.0.1 on an IPv4 network) which limits the scope for remote exploitation; as with any network server it may become necessary to permit remote access for some client applications (this change would be announced and explained to users).

This communication is encrypted by an SSL connection in a similar way to the protection offered during online payment transactions. This provides assurance to the RPC client that any data transferred across the connection is protected from eavesdroppers and is going to/from only the KeePassRPC plugin. If the local (server) machine is compromised and the private key stolen, a malicious application could pretend to be KeePassRPC. This is bad but damage is likely to be limited to collection of new password data and hence is unlikely to result in widespread data disclosure unless data collection occurs over a considerable length of time.

Being an open source application presents unique challenges to secure public/private key communication since all keys that are included in the application are by definition NOT private. KeePassRPC works around this by borrowing a bit of code from the Mono project which allows the generation of a new private/public key pair on the user’s machine. This key is then stored in the .NET key store, providing a certain amount of protection against malicious users stumbling across it.

A more concerning issue exists though: What if the attacker pretends to be an RPC client and connects to KeePassRPC to extract all password data? In this case it is irrelevant whether the client can trust KeePassRPC and the encrypted transport protocol does nothing to stop the attacker accessing data. This exploit is particularly interesting to an attacker if they can connect to KeePassRPC remotely since execution privileges on the server running KeePass would not be required.

An examination of the KeePassRPC source code will show that this eventuality has been anticipated and the user has been given tools with which to protect themselves against this threat, giving the KeePassRPC plugin reassurance that the client requesting authentication is who it claims to be. To do this, the client sends its name and a cryptographic signature of that name to KeePassRPC. Using the public key in the KeePassRPC source code the plugin is able to confirm that the client’s name is accurate.

Job done? Not quite…

What is to stop an attacker from impersonating a known client? For example, said attacker could just look in the KeeFox add-on source code to extract the official KeeFox name and signature and send those to KeePassRPC for successful authentication and full access to the user’s passwords!

Protection against this threat relies on the client application (e.g. KeeFox) storing a private identifier and sending this to KeePassRPC (again, this must be generated dynamically rather than stored in the public source code). The combination of claimed name, official confirmed signature and unique private identifier gives KeePassRPC assurance that the authentication request has come from a known client. This information is of course transferred over the already encrypted transport layer.

There is a remaining problem: How does KeePassRPC know that it can trust one client but not another? Unfortunately we have to defer to the user’s own judgement here. Any previously unknown clients must be presented to the KeePass user for confirmation before their first successful authentication. Any clients that the user authorises are recorded in the KeePass XML config file to enable automatic authorisation for all future requests from that same client. The actual data written to the config file consists of a hash of the combined client identifier signature and unique private identifier.

This STILL leaves some unanswered questions:

What if someone manipulates the KeePass config file? This is where point B (back at the top of the article) is most keenly highlighted – if an attacker can manipulate the KeePass config file they have a variety of options open to them to exploit the password data. On the off-chance that it is ONLY the config file that they can modify then I think that KeePassRPC may be exposing a new attack surface. “Never say never” but I think this situation is as close to never as you could safely get (why would this be the only writeable file?!) If any other files are writeable or new files can be created there are thousands of other easier ways to break into a KeePass database without messing around calculating suitable SHA hashes.

What if the user is tricked into authorising a malicious client? The authorisation dialog boxes are presented in a way that should reduce the likelihood of this happening but we must accept it is a possibility, perhaps especially among those users who do not fully understand the language of the questions they are asked by KeePassRPC.

So this protection results in the following required handshake between an RPC client and the KeePassRPC server:

Client -> Server: Standard SSL handshake to encrypt transport channel

Client -> Server: JSON-RPC “Authenticate” request sent, including client version number, client name, base64 encoded signature of client name and a base64 encoded private identifier

Server -> Client (assuming successful authentication): Return value of 0 (zero) to the “Authenticate” method request

As explained in the previous post, you will need to contact me in order to get the correct signature for your chosen client name.

There is a remaining issue [...]]]> Hot on the heels of version 0.8, I’m pleased to say I found a quick fix for the problems causing Firefox to fail to shutdown under certain circumstances and have released version 0.8.1 straight to the main download page so please upgrade to the version now available on http://keefox.org/download

There is a remaining issue related to this same underlying problem but I don’t anticipate it causing anyone a significant problem in practice.

Edit: Just to clarify, this is still Beta software – fixing this one bug, while important, is not enough in my opinion to result in a finished product!

Edit: 0.8.1 has been released with just one small bug fix. The download page now contains 0.8.1.

Main changes since 0.7

Some (of many) improvements since 0.7.3 include extra security layers, password generation from within Firefox, a “getting started” tutorial (needs special entries [...]]]> A new experimental development snapshot has recently been uploaded. If we can’t find too many serious problems compared to version 0.7 then this should become version 0.8 in a week or two.

Some (of many) improvements since 0.7.3 include extra security layers, password generation from within Firefox, a “getting started” tutorial (needs special entries in your password database), logins listed alphabetically and NTLM dialog autofill support.

Most of those features were available in 0.7.6 (released a couple of months ago); 0.7.7 also has all the improvements since 0.7 including lots of options to fine tune KeeFox behaviour with specific entries (albeit mostly through “advanced” strings rather than a pretty user interface, which will hopefully be coming in an experimental version soon after 0.8).

If you’re comfortable with experimental software and can spare some time to test it out, that would be very helpful. Please see the new experimental download page for important upgrade instructions and a summary of any known issues.

I don’t plan to drop support for 3.5 until after the release of KeeFox version [...]]]> Firefox 3.0 will not be officially supported by Mozilla for much longer and some planned KeeFox features will be easier to implement if I concentrate on version 3.5+ only. For these reasons, KeeFox version 0.8 will require Firefox 3.5+.

I don’t plan to drop support for 3.5 until after the release of KeeFox version 1.0 unless Mozilla officially withdraws support in the mean-time. However, to ensure you’re getting the fastest and most secure browsing experience, it is always advisable to upgrade to the latest Firefox version as soon as possible.

You can download Firefox from the official site.

I’ll publish an more in depth introduction to those files soon.

The RPC system is an implementation of [...]]]> KeePassRPC provides a remote access interface for KeePass Password Safe 2. There is currently no official release but you can view the source code in the KeeFox repository. The most interesting files are:

• DataExchangeModel.cs
• KeePassRPCService.cs
• KeePassRPCServer.cs

I’ll publish an more in depth introduction to those files soon.

The RPC system is an implementation of JSON-RPC; this is a simple protocol and probably does not support every possible desired feature but clients are easy to implement and libraries already exist for most programming languages.

Communication with the RPC server is currently via direct unencrypted TCP socket connections only. In future, I intend to add support for TLS encrypted sockets. It would also be possible to add a HTTPS server or even an alternative RPC protocol with the same API (e.g. XML web services). Although I think that a single plugin with a standardised API would be beneficial for KeePass plugin developers and users, we would need to avoid adding too many alternative access methods – a couple of protocols and a couple of transport mechanisms are probably OK though?

The API will experience minimal changes over the next few months because I need it to remain stable in order to ensure that version 1.0 of KeeFox can be released with well-tested components. As the release of KeeFox version 1.0 approaches, I intend to branch the development of KeePassRPC so that an improved version 2 API can be produced, hopefully with input from other developers interested in communicating with KeePass Password Safe. If requested, I may be able to produce this branch fairly soon.

In any event, I’d like to discuss what you might change about the API. What would you like to see? Is there any part that could be made simpler? What about user-interaction? Many parts of the API can trigger interaction with the user, is that a sustainable approach for a remotely accessible API or must we aim for a non-interactive service?

KeePassRPC is written in C# and utilises the JayRock libraries. It should run with the .NET Framework version 2.0 and higher as well as Mono, although thorough testing currently occurs only with .NET Framework 3.5 SP1.

This version includes the bug fixes from version 0.7.1 and adds these new features: