KeePass has been (and still is) a solid recommendation for managing passwords, but as an open-source project, alternative clients have emerged over time—and one of them is KeePassXC.
Password managers aren't having a good time, and the reason is obvious: they are priority targets for malicious actors out there. But today's story starts with the publication of CVE-2023-24055, a vulnerability associated with KeePass 2.53 and earlier versions.
How does the vulnerability work? KeePass has a trigger system that lets users automate certain actions. In its default parameters, an attacker with direct write access to KeePass's configuration file can program a trigger so that the database credentials are exported in plaintext and in the background without user confirmation once the database is opened.
But the real conflict arose because Dominik Reichl, KeePass's developer, not only decided to dispute the CVE's validity but also declared the equivalent of a 'wontfix'. Why? From his point of view, if an attacker has that level of access, the system is already compromised and can do much worse things. The debate in the official KeePass forum is fascinating, with strong arguments on both sides, but the real question is: What can the user do? In general, three paths are mentioned:
- Downgrade to KeePass 1.4x (which lacks the trigger system)
- Harden KeePass with a static configuration file
- Seek an alternative client like KeePassXC
KeePassXC: A Password Manager Compatible with KeePass
KeePassXC presents itself as a community fork of KeePassX, which in turn is a cross-platform port of KeePass. By not depending so much on the official client, KeePassXC sets aside both the trigger system and plugin support, something its developers outright reject. The program is available in multiple formats, from traditional installers and legacy (for Windows 7 and 8.x) to the Windows Store and access via Chocolatey / Winget.
One of the first things that surprised me about KeePassXC (but makes a lot of sense) is its screenshot blocking. The images you see here were only possible after adding the --allow-screencapture switch to the shortcut. Second, entering the database password isn't enough: it also asks for the Windows user profile password or PIN before opening. And finally, I found a modern interface with dark mode support and features that don't envy the original client.
If there's one more detail to highlight about KeePassXC, it's that its update cycles aren't as frequent as KeePass's, but since they're different projects, they don't need to be. Personally, I think I'll use KeePassXC for a couple of weeks. If KeePass's situation turns more negative, we definitely have a good replacement here.
Official website and download: Click here
