4 ms·

I use KeePass and I'm quite happy. The database is local and enrypted with AES. My master password is around 72bits of entropy. I keep 2 files actually. Day to

I use KeePass and I'm quite happy. The database is local and enrypted with AES. My master password is around 72bits of entropy. I keep 2 files actually. Day to day stuff and critical services. So I only open up and therefore expose my master password infrequently for the critical services. (i.e. banking etc.) I've enabled 2FA on everything I can. So I think I'm safer than this deterministic solution as if my master password gets out, you still have to get past 2FA.

kuzimoto 9y ago
I love using KeePass. I keep the database file at home and only use it remotely with a plugin to allow accessing it via SSH so that the file is never (permanently) stored on disk. I like to think that this is even more secure than other methods since even if someone were to log keystrokes, they would need to know the SSH server details as well to actually gain access to the file. It can also be used to store 2FA secrets and KeePass2Android lets you generate the TOTP pretty easily so you're not relying on an app such as Google Authenticator which (last time I used it) doesn't backup secrets, and app itself isn't password protected.
- 1ba9115454 9y ago
  Authy can be used instread of Google authenticator and backups up an encrypted copy of your secrets.
BeetleB 9y ago
>I've enabled 2FA on everything I can. This may make things less secure, especially if the second factor involves a phone. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... It's a lot easier than the article indicates to get control of your phone. People have just walked into the phone company's store and get whatever is needed to control your phone number. Security based on poorly trained frontline folks (i.e. the clerks at those stores) is the worst kind. I've fooled (or observed) leasing offices give the keys to an apartment to someone not on the lease. I've obtained hotel room keys that way. I've had checks cashed that were not signed.
- 1ba9115454 9y ago
  Most of my 2FA is via Google Authenticator or Authy.
- maturz 9y ago
  At worst enabling 2FA would make no difference but it will not make it less secure if you still need the password (might not always be the case but then it's not true 2FA). I would argue that even if it can be beaten it will add security since that extra hurdle can stop a lot of low effort attacks.

kuzimoto 9y ago

I love using KeePass. I keep the database file at home and only use it remotely with a plugin to allow accessing it via SSH so that the file is never (permanently) stored on disk. I like to think that this is even more secure than other methods since even if someone were to log keystrokes, they would need to know the SSH server details as well to actually gain access to the file. It can also be used to store 2FA secrets and KeePass2Android lets you generate the TOTP pretty easily so you're not relying on an app such as Google Authenticator which (last time I used it) doesn't backup secrets, and app itself isn't password protected.

1ba9115454 9y ago
Authy can be used instread of Google authenticator and backups up an encrypted copy of your secrets.

BeetleB 9y ago

>I've enabled 2FA on everything I can. This may make things less secure, especially if the second factor involves a phone. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ https://www.wired.com/2016/06/hey-stop-using-texts-two-facto... It's a lot easier than the article indicates to get control of your phone. People have just walked into the phone company's store and get whatever is needed to control your phone number. Security based on poorly trained frontline folks (i.e. the clerks at those stores) is the worst kind. I've fooled (or observed) leasing offices give the keys to an apartment to someone not on the lease. I've obtained hotel room keys that way. I've had checks cashed that were not signed.

1ba9115454 9y ago
Most of my 2FA is via Google Authenticator or Authy.
maturz 9y ago
At worst enabling 2FA would make no difference but it will not make it less secure if you still need the password (might not always be the case but then it's not true 2FA). I would argue that even if it can be beaten it will add security since that extra hurdle can stop a lot of low effort attacks.