New Feature: Apple Watch Integration

We’ve just released a new feature for our Pro users. Apple Watch Integration. You can now store your database entries on your Apple Watch. This is convenient for when you need a credential, note or 2FA Code and you’ve forgotten or not been able to take your phone with you. While we don’t recommend using your Apple Watch as the primary interface for Strongbox, it is a super handy backup, and you never know when it might save your day. 

Our Apple Watch integration is a Pro feature, and we hope you’ll find it both beautiful and useful in your day to day tasks.

Apple Watch Sample

For more details and step by step instructions, take a look at our Apple Watch guide here. Please do drop us a line if you like the feature or have any questions or comments. We’d love to hear from you.

New Feature: Hardware Key Caching

Introduction

We’ve just released a new feature for users of hardware keys. This feature is similar in some ways to our last, virtual hardware keys for Mac. It makes the use of hardware keys a bit more tolerable and convenient while maintaining a very high degree of security. Our new feature is a bit easier to manage, you don’t need to create a virtual key and/or know much about the secret stored within your hardware key.

What problem does this solve?

There are a few technical issues that make using a hardware key a bit more cumbersome than one might hope. First is the obvious physical requirement for the device itself, required for every unlock and usually for every update and edit. If there is a problem communicating with the device edits can be lost, or you can be locked out of your database for a while. Worse still, on iOS, AutoFill system limitations (e.g. no NFC access) and software impediments (e.g. poor third-party library support for AutoFill), make things difficult for us developers to provide a comfortable experience for our users.

What is Hardware Key Caching?

To explain what our new feature is, we must briefly explain how a hardware key is used to help secure your password database. Your hardware key can be programmed with a secret that is used in what’s called a “Challenge Response” function. For Strongbox and KeePass databases, this is the HMAC-SHA1 function, an open standard. This function takes an input, the “Challenge” and produces an output, the “Response”. The same challenge will always lead to the same response and is dependent on the “secret” hidden within your key or virtual key. It is computationally intractable/practically impossible to determine the response to a particular challenge without knowing the secret, and the devices are extremely resistant to anyone being able to extract that secret.

Strongbox and other clients (e.g. KeePassXC) that support hardware key protection via challenge response, use the response to help encrypt the database, along with a password if used, and/or a key file if provided. These individual factors (password, key file, and challenge response) are cryptographically combined to generate a composite key, which along with a transform key and a master seed is ultimately what generates the key that encrypts your database.

Hardware Key Caching works by intercepting the challenge & response used when unlocking the database, and then securely “caching” it. If Strongbox sees a subsequent request to encrypt or decrypt the database, it checks if it can provide the response from its cache, instead of requesting it from the physical hardware key. If so, it can help to alleviate multiple or overly frequent requests for the device. If it doesn’t know the response for a particular challenge, of course it falls back to requesting the physical device itself.

This simple strategy can make life surprisingly more comfortable for users with virtually no special technical ability required.

How to I enable Hardware Key Caching?

The most likely way you’ll enable hardware key caching is through our onboarding process which will ask you when you unlock your database whether you would like to turn this feature on. Below we describe how you can do that manually and also how you can adjust the settings or turn it off.

NB: You will need to be using a hardware key, be a Pro user and your database must be in KeePass 2.0 (KDBX 4.x) format to use hardware key caching.

On iOS

  1. Unlock your Database
  2. Tap the Settings button (Gear icon)
  3. Tap Hardware Key (see screenshot)
  4. Enable Challenge Response Caching
On macOS
  1. Unlock your Database
  2. Go to the Database Settings under Database > Database Settings menu item
  3. Click on the Hardware Key tab (see screenshot)
  4. Enable Challenge Response Caching

How is the challenge response securely cached?

Strongbox stores the challenge response pair securely using the Secure Enclave mechanism with a configurable expiry setting. As mentioned in previous articles the Secure Enclave provides exceptional protection for secret storage using a special separated and dedicated on chip device on your iPhone or Mac.

Conclusion

We hope this will encourage more users to give security keys a try, and make life easier for our existing users, especially when it comes to AutoFill. We would still recommend storing your hardware key secret somewhere very secure offline, e.g. in a physical safe. You can use this with our virtual hardware keys to recover from a device fault or loss. Drop us a line if you like the feature or have any questions or comments. We’d love to hear from you.

Virtual Hardware Keys now available on macOS

With the release of 1.60.16, macOS users can now use virtual hardware keys in place of physical keys. This can help make their lives a little easier and also provide a disaster relief fallback. We’ve had virtual hardware keys available on iOS for a while now. This was largely driven by the need for an AutoFill solution. For technical reasons communicating with physical devices in AutoFill mode on iOS ranges from difficult to impossible. So, our iOS users have used virtual hardware keys to workaround this issue. There are a number of reasons why you might want to use virtual hardware keys on macOS.

Convenience and Hardware Compatibility Issues

On macOS, things are more straightforward in AutoFill mode, though you may have other kinds of issues which virtual hardware keys could solve. For example, if your Mac doesn’t have the right kind of USB port or if your YubiKey only uses NFC which is unavailable on Mac.

Another reason to use a virtual hardware key is the convenience it provides. It is essentially a secure functional clone of your physical key. This effectively turns your iPhone/iPad or Mac into a copy of your hardware key.

A more extreme or interesting use-case we’ve come across in the wild (literally) is from a user who has an emergency “bug-out” shelter way up in the remote backcountry of the Rocky Mountains. Out there he maintains some devices on which he has setup a virtual hardware key. This is just in case he has to bail out of civilisation (while forgetting his physical key), when the zombie apocalypse or whatever it may be occurs. We’re heartened to know Strongbox might survive the collapse!

Disaster Recovery

Another reason you might choose to setup a virtual hardware key is disaster recovery. If you were to somehow lose your physical key and your backup of that key (you do have a backup, right?) then you would be completely locked out of your database. However, you can use a virtual hardware key to recover from this situation. All you need is the secret you programmed your physical key with, you know, the one you stored in a secure offline location like your physical safe, just for this sort of emergency recovery scenario.

How to Setup a Virtual Hardware Key on macOS

Setting up a virtual hardware key on macOS is very straightforward and easily accessible from the standard lock screen:

macOS Lock Screen
  1. Go to the Lock Screen of your database
  2. Ensure you have checked Show Advanced
  3. Under the Hardware Key section click the dropdown
  4. Click New Virtual Hardware Key…
New Virtual Hardware Key Screen
  1. Enter a name for your virtual hardware key e.g. ‘My Backup Key’
  2. Enter the secret you programmed your physical key with (This is the HMAC-SHA1 Challenge Response secret)
  3. Click Add.
  4. This key will now be available in the Hardware Key section of the lock screen for use with your databases.

How to delete a Virtual Hardware Key on Mac

This is very straightforward:

  1. Go to the Lock Screen of your database
  2. Ensure you have checked Show Advanced
  3. Under the Hardware Key section click the dropdown
  4. Hold down the Option (⌥) button and click on the key you’d like to delete
  5. You will be asked to confirm. Click Yes.

Technical Security Considerations

We sometimes get asked about the security of virtual hardware keys and that’s understandable. The people using them have very high security demands and we can understand the anxiety. Short answer, these virtual keys are very, very secure. Long answer, the secret is protected by the on device Secure Enclave which provides an excellent industry leading level of security. In essence using virtual hardware keys turns your device into a secure functional clone of your physical key. Just as the secret is stored securely on your physical key, the secret is stored securely on your iPhone/iPad or Mac.

One could argue over the relative security provided by the physical key secure storage vs the Apple Secure Enclave storage but there’s no real question that both provide a very high degree of security for the secret stored within. We personally think for most if not all users the difference is academic and not something that should cause major concern.

As with all things security, it is rarely, if ever a binary, secure vs insecure, but rather a spectrum from less to more secure. Your threat model may vary, and you will need to decide on the security vs convenience trade-off that works for you. If you feel that there is some threat to the Secure Enclave technology that is realistic for your scenario then, absolutely, do not use it. We are not aware of any serious or practical attacks on the technology at the time of writing. Of course, there’s always the possibility the NSA or CIA or whomever has some kind of ability like this, though even there, we have our doubts, but if they’re in your threat model, then, sure, you’re probably going to want to avoid this convenience feature.

Move Your Passwords from Bitwarden to KeePass on Mac or iPhone

Moving to KeePass from Bitwarden can provide many benefits. In this post, we’re going to explain why you might want to switch to KeePass and how to do it quickly and easily.

If you’re only interested in the how-to, you can skip straight to the step-by-step guide.

Why

Portability

KeePass is an open standard file format for storing password databases. Databases are stored as KDBX files. These files can be opened and edited by any KeePass compatible app or client.

This has various advantages. For one thing, you won’t have to go through a laborious import/export process the next time you want to use a different password management app! Once you have your KDBX database file, you can instantly and seamlessly open and edit it in various other apps. This allows you to experiment and find the best app for your needs.

You can use different password management apps on your phone and your computer with the same database file. You could do the same thing with different apps for Mac, Linux and Windows computers.

There are many more reasons to switch to KeePass, see here for just a few.

How to Switch to KeePass

In order to follow the steps below, you’ll need to download the Strongbox app on your iPhone iPad or Mac.

Strongbox is a free and open source password manager that uses the KeePass file format. It’s available on iPhone, iPad and Mac.

There’s a Pro version of the app available but the free version has everything you need to import, view and edit your passwords. And if you later decide you don’t want to use Strongbox, it’s easy to use your new KeePass database with another compatible app; there’s no lock-in.

Step 1: Exporting from Bitwarden

  1. Go to Bitwarden on the web and unlock your vault normally found here https://vault.bitwarden.com/.
  2. Click Tools in the top menu bar and choose Export Vault (see Screenshot below).
  3. Make sure you select JSON as the File Format and click Confirm Format.
  4. You will be asked to re-enter your master password. Do so and then click Export Vault.
  5. Save the resulting JSON file in a convenient location available for step 2 below.
Bitwarden Export

Step 2: Import Bitwarden JSON using Strongbox

Choose from the instructions below depending on whether you’re importing using your Mac or iPhone/iPad…

2a) On your Mac (macOS)
  1. Open Strongbox, and click File > Import > Bitwarden (JSON) menu item – see screenshot below.
  2. Locate and select the Bitwarden JSON file that you exported in Part 1 above. Strongbox will confirm the import was successful.
  3. You now need to set a master password for your new Strongbox database. This can be the same as your old Bitwarden master password if you like.
  4. Lastly, save your new Strongbox database either locally or on your favourite cloud drive.
  5. Check your entries in Strongbox to make sure all of your data has been imported successfully.
strongbox-import-bitwarden
2b) On your iPhone or iPad (iOS)
  1. Move the Bitwarden JSON file that you exported in Part 1 above into a location that can be accessed by your iPhone/iPad.
  2. Open Strongbox and tap the Plus Symbol (+) in the top right of the screen.
  3. Tap More > Bitwarden (JSON)… and follow the on screen instructions
  4. Check your entries in Strongbox to make sure all of your data has been imported successfully.
import-ios-bitwarden

Step 3: Cleanup

  1. Delete the JSON file that you exported from Bitwarden.

Next Steps

If you want to get familiar with Strongbox, check out our Getting Started guide. We also have extensive help articles available.

And if you have any feedback or issues, don’t hesitate to contact our support team: support@strongboxsafe.com

Move Your Passwords from Enpass to KeePass on Mac or iPhone

KeePass offers a number of advantages over Enpass. In this post, we’re going to explain why you might want to switch to KeePass and how to do it quickly and easily.

If you’re only interested in the how-to, you can skip straight to the step-by-step guide.

Why

Portability

KeePass is an open standard file format for storing password databases. Databases are stored as KDBX files. These files can be opened and edited by any KeePass compatible app or client.

This has various advantages. For one thing, you won’t have to go through a laborious import/export process the next time you want to use a different password management app! Once you have your KDBX database file, you can instantly and seamlessly open and edit it in various other apps. This allows you to experiment and find the best app for your needs.

You can use different password management apps on your phone and your computer with the same database file. You could do the same thing with different apps for Mac, Linux and Windows computers.

Transparency

Enpass is closed source. This means that the source code is not available for inspection on open source websites like Github. This does not in and of itself mean that Enpass is doing something suspicious. It’s just not confidence inspiring, and with a tool for managing your most important secrets, we think that’s just not good enough. We always recommend going with Open Source solutions like Strongbox.

How to Switch to KeePass

In order to follow the steps below, you’ll need to download the Strongbox app on your iPhone iPad or Mac.

Strongbox is a free and open source password manager that uses the KeePass file format. It’s available on iPhone, iPad and Mac.

There’s a Pro version of the app available but the free version has everything you need to import, view and edit your passwords. And if you later decide you don’t want to use Strongbox, it’s easy to use your new KeePass database with another compatible app; there’s no lock-in.

Step 1: Exporting from Enpass

  1. Open Enpass on your Mac and unlock your vault.
  2. Go to the menu bar at the top of your screen and click File > Export.
  3. You will be presented with a sidebar (see screenshot below)
  4. Ensure that the format is .json.
  5. Click on the small Folder icon under Choose Location and select a filename and location to export to.
  6. Click Export.
Enpass Export Side Bar

Step 2: Import Enpass JSON using Strongbox

Choose from the instructions below depending on whether you’re importing using your Mac or iPhone/iPad…

2a) On your Mac (macOS)
  1. Open Strongbox, and click File > Import > Enpass (JSON) menu item – see screenshot below.
  2. Locate and select the Enpass JSON file that you exported in Part 1 above. Strongbox will confirm the import was successful.
  3. You now need to set a master password for your new Strongbox database. This can be the same as your old Enpass master password if you like.
  4. Lastly, save your new Strongbox database either locally or on your favourite cloud drive.
  5. Check your entries in Strongbox to make sure all of your data has been imported successfully.
strongbox-mac-import-enpass
2b) On your iPhone or iPad (iOS)
  1. Move the Enpass JSON file that you exported in Part 1 above into a location that can be accessed by your iPhone/iPad.
  2. Open Strongbox and tap the plus symbol (+) in the top right of the screen.
  3. Tap More > Enpass (JSON)… and follow the on screen instructions
  4. Check your entries in Strongbox to make sure all of your data has been imported successfully.
import-enpass-ios

Step 3: Cleanup

  1. Delete the JSON file that you exported from Enpass.

Next Steps

If you want to get familiar with Strongbox, check out our Getting Started guide. We also have extensive help articles available.

And if you have any feedback or issues, don’t hesitate to contact our support team: support@strongboxsafe.com

Move Your Passwords from LastPass to KeePass on Mac

KeePass offers a number of advantages over LastPass. In this post, we’re going to explain why you might want to switch to KeePass and how to do it quickly and easily.

If you’re only interested in the how-to, you can skip straight to the step-by-step guide.

Why

Security

LastPass has a long history of security incidents and data breaches. Most famously, in August 2022, hackers gained access to LastPass user accounts and stole customer’s password vaults, names, IP addresses, phone numbers and billing addresses.

There have been several other attacks dating all the way back to 2011. For instance, in 2021, many LastPass users received emails informing them that their master passwords had been compromised. And in 2015, LastPass’ servers were compromised and attackers were able to access hashed master passwords, cryptographic salts and customer email addresses.

KeePass databases, by comparison, are not stored in a centralised location that’s vulnerable to attack. It gives you control of your data and you decide where it is stored. That could be in a cloud storage provider of your choice, on your own server, or local-only, for the ultimate security. You also have access to more advanced security settings, such as which encryption algorithm to use and whether to use a two-factor authentication method, like a YubiKey and/or a key file.

(The downside of all this control is that there’s no safety net. If you forget your master password, it cannot be recovered!)

Privacy

It was discovered in 2021 that the LastPass Android app includes several third-party trackers embedded in its code. Whilst this is not necessarily an issue, privacy conscious users have good reason to be concerned:

The amount of data does seem to be extensive, revealing information about the device in use, the cell phone carrier, the type of LastPass account, and the user’s Google Advertising ID (used to connect data about the user across apps). It’s enough data to build an extensive profile around the most private information you store.

Josh Hendrickson, Review Geek

Many KeePass apps are open source (such as Strongbox) and their code can be inspected to ensure there are no trackers present.

Portability

KeePass is an open standard file format for storing password databases. Databases are stored as KDBX files. These files can be opened and edited by any KeePass compatible app or client.

This has various advantages. For one thing, you won’t have to go through a laborious import/export process the next time you want to use a different password management app! Once you have your KDBX database file, you can instantly and seamlessly open and edit it in various other apps. This allows you to experiment and find the best app for your needs.

You could use different password management apps on your phone and your computer with the same database file. You could do the same thing with different apps for Mac and Windows computers. Cloud storage drives offer an easy way to sync the changes between different devices, but it’s also possible to use your own server, Wi-Fi transfer or a simple USB cable.

Cost

LastPass offers free and paid tiers. However, some of the more basic features are locked behind a paywall, including being able to sync your password database across multiple devices. There is also no “Lifetime” purchase option available, which means that you are stuck paying for a monthly or yearly subscription for as long as you use their service.

Because KeePass is compatible with many different apps, there are various different prices and payment options available.

There are many KeePass clients that offer basic functionality at no cost. The official KeePass app is one example. You can even extend its feature set via a library of free plug ins.

And, if you’re willing to pay, there are also great KeePass app options with better user interfaces and more advanced features. Features such as Face ID unlocking, browser AutoFill, YubiKey support, automatic backups, WebDAV and SFTP support, and much more.

Whilst LastPass (and other similar services) lock you into their payment model, once you’ve created your KeePass database, you can easily and instantly try different KeePass apps and find which one is right for you.

How to Switch to KeePass

In order to follow the steps below, you’ll need to download the Strongbox app.

Strongbox is a free and open source password manager that uses the KeePass file format. It’s available on iPhone, iPad and Mac.

There’s a Pro version of the app available but the free version has everything you need to import, view and edit your passwords. And if you later decide you don’t want to use Strongbox, it’s easy to use your new KeePass database with another compatible app; there’s no lock-in.

Pre-Switch Considerations

LastPass vaults can only be exported as CSV files. This means that usernames, emails and passwords are exported, but many other types of data are not.

For instance, it’s not possible to export file attachments from your LastPass vault. That means that you need to manually download these attachments from LastPass and then add them to your KeePass database.

Unfortunately, the same goes for notes, custom fields, addresses and TOTP codes in LastPass. After you’ve imported your LastPass logins to a new KeePass database, you’ll need to go through and manually add these back in.

Step 1 – Export a CSV from LastPass.com

  1. Go to lastpass.com
  2. Log into your account
  3. At the bottom of the left-hand column, click Advanced Options
  4. Under the Manage Your Vault heading, click Export
  5. Open the email from LastPass with the subject ‘LastPass Security Notification: Verify export’
  6. Click the Continue export link in the email to go to another webpage
  7. Go back to your vault on lastpass.com and, once again, click Advanced Options > Export
  8. Enter your LastPass master password
  9. Locate the CSV file that is downloaded to your device (called ‘download.csv)

For more detailed instructions see the guide on LastPass’ website.

Step 2a – Import Using Strongbox on Mac

  1. Open Strongbox on your Mac
  2. Click File (in the menu bar) > Import > LastPass (CSV)…
  3. Locate and select the CSV file that you exported in Part 1 above. Strongbox will confirm the import was successful
  4. You now need to set a master password for your Strongbox database. This can be the same as your old LastPass master password if you like.
  5. Lastly, save your new Strongbox database either locally or on your favourite cloud drive
  6. Check your entries in Strongbox to make sure all of your data has been imported successfully
  7. Delete the CSV file that you had exported from LastPass

Step 2b – Import Using Strongbox on iPhone/iPad

  1. Move your CSV file into a location that can be accessed by your iPhone/iPad
  2. Open Strongbox on your iPhone or iPad
  3. Tap the plus symbol (+) in the top right of the screen
  4. Tap More
  5. Tap LastPass (CSV)…
  6. Follow the instructions to create the new database
  7. Check your entries in Strongbox to make sure all of your data has been imported successfully
  8. Delete the CSV file that you had exported from LastPass

Step 3 – Add Missing Data

You should now have a KeePass database file that contains all of your logins from your old LastPass vault. The entries in your database will include usernames, emails and passwords, but not file attachments, notes, custom fields, addresses and TOTP codes. Unfortunately LastPass does not allow this extra data to be easily exported/imported.

You will need to go through your LastPass vault, manually download attachments and add them to entries in your KeePass database. And you can copy and paste any other information–such as notes and custom fields–that you would like to move across.

Next Steps

If you want to get familiar with Strongbox, check out our Getting Started guide. We also have extensive help articles available.

And if you have any feedback or issues, don’t hesitate to contact our support team: support@strongboxsafe.com

WebDAV and SFTP Now Available on macOS

Strongbox now supports WebDAV and SFTP on macOS. These new storage providers have been much requested because they provide the ability to host your own KeePass database on your own storage, in a way that allows for synchronisation across devices and availability from anywhere on the Internet (if you like).

Note: The WebDAV & SFTP are part of the macOS Pro feature set

WebDAV and SFTP are public open protocols supported by a wealth of different devices. Indeed SFTP is probably the standard way of transferring files on Linux based systems. Because it is built on top of SSH it is also the most secure way to do this also. WebDAV is an open extension of HTTP, adding new methods like PROPGET and PROPFIND and can sit seamlessly on top of a regular HTTP(S) session. In particular WebDAV is supported by Nextcloud and Owncloud, 2 popular up and coming privacy conscious storage solutions, which allow users to operate or subscribe to their own personal storage solution. Often Nextcloud runs on top of a NAS. Alternatively, many NAS’s support WebDAV and SFTP natively, for example Synology and QNAP provide their own implementations.

If you’re not keen on storing your database on your cloud provider, perhaps a free Dropbox or Google Drive account, but you want the convenience of a centralised location to store your password database, then WebDAV or SFTP could be for you. Strongbox tries to make this straightforward and has supported these protocols on iOS for quite a while. Now these protocols are available on macOS.

To add a WebDAV or SFTP hosted database to Strongbox, simply:

  1. Launch Strongbox and bring up the Databases Manager window (Command + D).
  2. Tap the ‘Add Database…‘ button in the bottom right hand corner and select WebDAV or SFTP as preferred
  3. You’ll now be prompted to enter the location of your server, and authentication information. Tap Connect when done.
  4. Once successfully authenticated against your server you can start to browse your files and folders.
  5. Locate your database, and tap Select.
  6. You should now have added this database and you’ll be presented with the Unlock screen.
Strongbox SFTP Setup – Browsing for a database on macOS

Strongbox will sync your changes back and forth (merging automatically where necessary). Strongbox also checks if your database has been changed by another process periodically and updates it if so, so you’re always working with the latest version.

We hope you’ll like this feature and that it’ll all be smooth sailing, of course we’d love to hear what you think and if we can improve in any way!