#1757 Encrypt or otherwise protect Notes field for password entries

KeePass
closed
nobody
None
5
2013-10-28
2013-07-26
Jeff Fritz
No

Tested using KeePass 1.26:

While using AutoIT/AutoHotKey's WindowSpy utility I discovered that all text in the notes field for an entry is freely visible. It is visible even when "Show Entry View" is disabled.

I expected this information to be protected in similar fashion to the passwords for each entry in the kdb.

Users may be putting in sensitive information such as serial numbers, answers to password hints, certificate information, etc in this field for their reference -- under the assumption it is reasonably protected. I think this is a valid and common use case.

Temporary fix suggestion -- Suggest a website documentation update with stronger wording to indicate this field is NOT protected from spying as the password fields are.

I would love to see this data be protected from viewing as the password fields are.

Discussion

  • Paul
    Paul
    2013-07-28

    By default only the password is protected in memory - this is the same as you see on most login pages where the user name is visible and the password is not. Hiding additional fields is only possible in KeePass V2.

    If you have malware on your computer then hiding the KeePass data is pretty much pointless anyway.

    cheers, Paul

     
  • Jeff Fritz
    Jeff Fritz
    2013-08-05

    Paul, I understand your points. If you're implying that there should be no action here, then I disagree. I hope that's not the case.

    At the very least, as I suggested, I recommend a documentation update to increase awareness of this shortfall.

    Indeed, if you have malware then Keepass altogether may be "pointless". That seems a little defeatist. I'm not sure why you argue this, though I submit that maybe it's a common scapegoat around here to not implement fixes.

     
  • Jeff Fritz
    Jeff Fritz
    2013-08-22

    Upon further research:

    • This has less to do with in-memory protection and more to do with data being made available via windows APIs. I am using AutoHotKey's WindowSpy utility to view text that is freely readable from any window handle using windows API.

    • For Keepass 2, Text in the notes field is NOT made available to the windows API in one scenario: the Notes field is BOTH shown AND masked with asterisks under View > Configure Columns.

    Text in the notes field is made available to the windows API in these cases:
    1. If the Notes field is hidden (masked or not)
    2. If the Notes field is shown and not masked

     
  • Dominik Reichl
    Dominik Reichl
    2013-10-28

    • status: open --> closed
     
  • Dominik Reichl
    Dominik Reichl
    2013-10-28

    The documentation only mentions that sensitive data like passwords are in-memory protected.

    In-memory protection requires that data is hidden by asterisks. If KeePass would hide all other data (notes, user names, URLs, ...), too, KeePass would be unusable.

    Best regards,
    Dominik