Hi folks, "QtPass" is a separate project entirely from pass. It shares no code with password store. However, the developer of "QtPass" hangs out on this list, is part of the greater pass community, and "QtPass" is in fact compatible and made to work with pass. Given the grave nature of a recent software vulnerability in "QtPass", I feel like it might be responsible to inform this list about it, in case there are any users of this third party software here, despite it not actually being related to the development of password store.
Bug report is here: https://github.com/IJHack/QtPass/issues/338 Fix landed in v1.2.1: https://github.com/IJHack/QtPass/releases/tag/v1.2.1 All passwords generated with "QtPass"'s built-in password generator are possibly predictable and enumerable by hackers. The generator used libc's random(), seeded with srand(msecs), where msecs is not the msecs since 1970 (not that that'd be secure anyway), but rather the msecs since the last second. This means there are only 1000 different sequences of generated passwords. If you're using this software, now would be a good time to change all your passwords and regenerate them using a secure utility such as pass (what this mailing list is about), or update to the latest version of this third party "QtPass" software and regenerate from there. The fix I proposed to the "QtPass" developers involves using Qt 5.10's built-in CSPRNG wrapper, or /dev/urandom for older Qt versions. Regards, Jason _______________________________________________ Password-Store mailing list [email protected] https://lists.zx2c4.com/mailman/listinfo/password-store
