I was thinking about how all of my passwords are compromised if I have malware on my system. It made me wonder, does Vaultwarden or KeePassXC/KeePassDX offer better protection on a malware infected system?
Vaultwarden
- Only accessed locally via LAN/VPN
- Set up for 2 factor authentication using WebAuthn (FIDO)
KeePasssXC/KeePassDX
- Synced locally via syncthing
- Set up for 2 factor authentication using HMAC-SHA1 Challenge-Response
- All clients blocked from internet access
I don’t use browser extensions and I manually copy/paste my passwords to fill in entries.
KeePass has good memory protection, but the 2FA can be read from USB and doesn’t change every time the database is decrypted. Vaultwarden enables the more secure FIDO2 2FA, but to my knowledge has less secure memory management as the entire entire database is decrypted on unlock.
You’re thinking about this wrong.
Instead of trying to pick the one that will handle a fail state best, you can more effectively assume a fail state and take steps to mitigate it. That is to say: implement key (in your case, password) rotation.
Just establish a trusted system, log in and change your passwords periodically.
You can even do rolling rotation where you only change a few each week.
If that doesn’t seem like the right choice to you, then consider this: you’re thinking about an unconfirmed or possibly even uninvestigated situation where your secrets have been compromised. The solution isn’t to find the secret handling software that deals with this situation in the best way possible, it’s to change secrets.
I don’t use browser extensions and I manually copy/paste my passwords to fill in entries.
On most systems copy pasting is heavily insecure since a lot of processes have access to the clipboard. autotype and thinga like browser extensions are considered more secure.
I’ll start by saying that if your device is infected with malware and they can access memory as the root user of the system there’s very little you can do. Also, I’m not a security professional by any means, nor am I a desktop application developer - I’ve mostly done stuff with web services/applications, but I’m going to go out on a limb and say that KeePassXC will be more secure.
When you login to the Vaultwarden web application it’s going to exchange your passphrase for a private key. Ideally, this exchange is done over HTTPS with certificates you have trusted (not ignored), but it’s still an exchange of your keys over the network. So, you must always be able to trust your network, even if using HTTPS, and be able to attest for yourself that neither your VPN nor your LAN have been tampered with in anyway that could allow for a man-in-the-middle attack. You also have to be able to trust your web browser, add-ons, and system, because your passwords (at some point) are going to be unencrypted JavaScript strings floating around in memory.
In comparison, a KeePass database is, in your case, only going to be transferred over the network via Syncthing, which you can now set a custom encryption passphrase for, while being a fully[1] encrypted file. The processing for KeePass will also be done on-device and can be sand-boxed using Snap/Flatpak or ran using FireJail and supposedly, as you mentioned, as good memory protection.
[1]: Some optional metadata, like a database display name and icon aren’t encrypted.
Edit: I feel like I didn’t answer the question enough, so feel free to ask any further questions, I’ll try my best to answer.
Also, I don’t think that 2FA is going to protect against malware that much. Hackers usually take advantage of how memory is allocated for an example, in 2019, Google estimated 90% of vulnerabilities in Android and ~70% of Microsoft security patches being related to memory safety.
When you login to the Vaultwarden web application it’s going to exchange your passphrase for a private key.
bitwarden is end to end encrypted: your decryption keys never leave your device, and the server certainly never sees them
you must always be able to trust your network
this would be a horrible password manager. this is also not how bitwarden works
you do still need to trust your server if you use the web interface, because any web interface can serve malicious components to exfiltrate whatever they like but native apps, assuming they’re verified appropriately, could communicate over HTTP and still not allow anyone actively monitoring your network to see any data that would be particularly useful
Maybe I’m misunderstanding something then, what’s the private key embedded within the client API’s profile response?
the entire entire database is decrypted on unlock.
That would be the selling point for me to choose KeePassXC over Vaultwarden.
For high value accounts, use 2fa with hardware tokens if you can, and maybe use front a dedicated computer (old laptop) with a bare bones software installation to minimize the likelihood of malware.
The way I see it, Password managers protect best against website password leaks.
By making it really easy to have different passwords for everything, one password leak won’t compromise your entire online portfolio.
The self managed nature of keypass and vault warden makes them less susceptible to a major fup outside your control, i.e A business can’t mismanage your passwords resulting in a major leak or deletion. For better or worse, you’re in charge of your own database.
They won’t protect you from various malware, except maybe a key logger that doesnt know how to copy the file? If someone actually wanted into your database without brute force, they could figure it out. If you find malware that’s been on your system for a while (longer than you download something and AV stops it before running), change all your passwords. Luckily you’ll have a handy list of everything.
If there’s malware on your system, when you can read it, the malware can read it.
