Thanks for your email regarding this issue.

Hi geschrieben,

I’m sorry that your credit card information was unfortunately stolen by somebody. I guess you’ve already contacted your bank to protect your account, and hopefully got unauthorized purchases reserved.

Regarding my credibility, I understand why you felt so bad. I’m a developer from Singapore, and I’m a Vietnamese, thus, my Vietnamese name Trần Ngọc Văn. I’m a full-time software developer, but since 7Pass is only a side project, so I don’t want to involve my company here.

Regarding the behaviour of 7Pass, you can actually download the .xap files directly from the MarketPlace, unzip it and use decompilers (dotPeek, ILSpy, Reflector, etc…) to verify the code. The code is not obfuscated at all so you’re free to look around. That .xap file that you download from MarketPlace is the exact file that is installed on your phone. Please don’t confuse it with the one on GitHub, which is built by my computer. Only the one from the MarketPlace is certified by Microsoft.

For your information, you should enable the “Enter masterkey on secure desktop” for the desktop version of KeePass, which will then uses a secure (elavated) desktop, for more secured master key entry.

Also a side note: all MarketPlace developers are verified that their identity exists (meaning there is at least a real person behind the account). If you still have any doubt, please contact Microsoft MarketPlace for further help. I hope they can help you investigate 7Pass to see if there is any trojan behaviour.

I’m sorry that this unfortunately incident, but I highly doubt that it was caused by 7Pass.

Regards,
Tran Ngoc Van

Sadly I cannot say the same for 7Pass.

So you trust someone in Asia you dont even know to store all your sensitive information?

I never entered my card on websites of phishing emails, I have antivirus and firewalls and I dont think they where guessed, we are talking about different credit cards under my name from different banks, so this is not a coincidence. Unless a major brand merchant was hacked and their credit card details database was stored. If this was true we would hear it in the news about thousands of credit cards compromised.

Of course I dont think the link from the Texas link is the programmers, what I wanted to point out if that that name is probably not even real, yes, he could be someone in Asia called like that.

My point is that database used with 7Pass was compromised, specially credit cards. Its not was not KeePass but 7Pass. You cannot possible know if 7Pass is connecting in the background to the Internet. Unless Mastercard itself was hacked and credit cards where stolen.

I dont trust this app anymore after this. It very suspicious that after putting my credit card numbers into 7Pass they where sold in the Internet and where almost immediately compromised.

Nobody knows the author of this app, he is like a ghost, so be very careful with you open with this app. Do your research, you will not find anything about the coder, he really tries to hide his identity. There must be a reason for this.

the number in the database could only be read, if someone has your masterkey. the database itself is very secure. you can ask the original developer under http://www.keepass.info. there is also a international and german forum about KeePass at sourceforge. For the sourcecode of 7Pass you can check the developer git hub (you can follow the link in the blog post). there you can see the sourcode.

when you want a german translation of my answer, please feel free to comment.

Hast du den gescheckt wer hinter diesen app ist? Der autor heisst 7Pass by Tran Ngoc Van, wier wissen nichts mehr, und seine seite ist eine kostenlose WordPress seite.

Das ist glaub lch nichtmal einen echtes name:
Erstes link mit Google fuer den name:
http://www.amw.com/fugitives/brief.cfm?id=68841

Mein deutsch is nicht gut aber bitte pruefe wo sich diese app im Internet anwendet, ich glaub es ist eine troyaner.

Noch einen schönen Tag