search

subdavis / Tusk

🐘 🔒 KeePass-compatible browser extension for filling passwords.
https://subdavis.com/Tusk
Other
468 stars 72 forks source link

NOT an incorrect password #311

Closed Stephan-P closed 5 years ago

Stephan-P commented 5 years ago

I'm trying to see if Tusk would be a the right browser extension for me and my KeePass kdbx. Unfortunately I'm not getting very far, because Tusk cannot open the kdbx, reporting that the password I entered is incorrect. Luckily I can check the password I entered by clicking the View icon and I can confirm that the password I entered in Tusk IS correct when applied from KeeWeb or KeepassXC. Did Tusk just harvest my kbdx password?

OS: Windows 10 64-bit 1809 Browser: Vivaldi 2.5.1511.4 .kdbx location: OneDrive (OneDrive app connection established and confirmed)

f-fouad commented 5 years ago

The same applies to me. I changed my password to a more longer one and I can't open the file from Tusk anymore. I do unlock the database from KeeWeb and KeepassXC. The password was changed to more than 13 chars if it can helps.

Stephan-P commented 5 years ago

I'm relieved that I'm not alone in this. FWIW, mine also has more than 15 characters

f-fouad commented 5 years ago

In my case, I found argon2 with memory value greater than 120Mib causes Tusk to immediately return incorrect password without verifying it. Could you confirm @Stephan-P that you are using Argon2 with a higher memory value.

Stephan-P commented 5 years ago

I wouldn't know if I'm using Argon2 or what. How can I retrieve this information from my database?

mathstuf commented 5 years ago

It works fine for me (password is > 20 characters), but my database is also years old. As for finding out what encryption your database uses, the Android app I use says it in the "Database settings" once it is open.

subdavis commented 5 years ago

Definitely didn't harvest your password -- promise.

Argon2 support is patchy and needs to be reimplemented properly with WASM.

This is related to #268