{"action":"created","issue":{"url":"https://api.github.com/repos/luckyrat/KeeFox/issues/597","labels_url":"https://api.github.com/repos/luckyrat/KeeFox/issues/597/labels{/name}","comments_url":"https://api.github.com/repos/luckyrat/KeeFox/issues/597/comments","events_url":"https://api.github.com/repos/luckyrat/KeeFox/issues/597/events","html_url":"https://github.com/luckyrat/KeeFox/issues/597","id":125430921,"number":597,"title":"How secure is it?","user":{"login":"Marsfan","id":9311953,"avatar_url":"https://avatars.githubusercontent.com/u/9311953?v=3","gravatar_id":"","url":"https://api.github.com/users/Marsfan","html_url":"https://github.com/Marsfan","followers_url":"https://api.github.com/users/Marsfan/followers","following_url":"https://api.github.com/users/Marsfan/following{/other_user}","gists_url":"https://api.github.com/users/Marsfan/gists{/gist_id}","starred_url":"https://api.github.com/users/Marsfan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Marsfan/subscriptions","organizations_url":"https://api.github.com/users/Marsfan/orgs","repos_url":"https://api.github.com/users/Marsfan/repos","events_url":"https://api.github.com/users/Marsfan/events{/privacy}","received_events_url":"https://api.github.com/users/Marsfan/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-07T16:38:37Z","updated_at":"2016-01-24T18:01:58Z","closed_at":"2016-01-24T18:01:58Z","body":"So I have been using this plugin. It seems great, but how can I confirm that it is secure. Could someone point me to a 3rd party source that confirms this?"},"comment":{"url":"https://api.github.com/repos/luckyrat/KeeFox/issues/comments/174325538","html_url":"https://github.com/luckyrat/KeeFox/issues/597#issuecomment-174325538","issue_url":"https://api.github.com/repos/luckyrat/KeeFox/issues/597","id":174325538,"user":{"login":"luckyrat","id":1211375,"avatar_url":"https://avatars.githubusercontent.com/u/1211375?v=3","gravatar_id":"","url":"https://api.github.com/users/luckyrat","html_url":"https://github.com/luckyrat","followers_url":"https://api.github.com/users/luckyrat/followers","following_url":"https://api.github.com/users/luckyrat/following{/other_user}","gists_url":"https://api.github.com/users/luckyrat/gists{/gist_id}","starred_url":"https://api.github.com/users/luckyrat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/luckyrat/subscriptions","organizations_url":"https://api.github.com/users/luckyrat/orgs","repos_url":"https://api.github.com/users/luckyrat/repos","events_url":"https://api.github.com/users/luckyrat/events{/privacy}","received_events_url":"https://api.github.com/users/luckyrat/received_events","type":"User","site_admin":false},"created_at":"2016-01-24T18:01:58Z","updated_at":"2016-01-24T18:01:58Z","body":"I'm not aware of any official security reviews but the wiki has lots of technical information describing how secure it is and the implementation is open for all to see. As you'll see from the wiki, while there are a few novel approaches, the key building blocks of both KeeFox and KeePass are independent 3rd party secure implementations (e.g. Firefox/NSS and .NET crypto primitives) which significantly reduces the risk of implementation problems and means that the customised protocols are simpler to analyse. I know other people have reviewed the protocols and implementation and were satisfied but it's another matter entirely to put ones name to an official statement of security.\r\n\r\nI'm closing this issue since it's not directly actionable (and open issues here don't tend to attract 3rd party attention any more than closed ones) but if you do find any 3rd party confirmation, I'd be interested to see some new comments here."}}