4 ms·

Don’t you also store the 2FA recovery codes in the PW manager though? I haven’t found any other good method for this other than printing them out but that comes

Don’t you also store the 2FA recovery codes in the PW manager though? I haven’t found any other good method for this other than printing them out but that comes with its own issues obviously.

akerl_ 8y ago
No, for exactly this reason. My recovery codes are on index cards in a physical safe, and then I've got MFA via multiple devices (TOTP on Phone + yubikey for most things).
- dontbenebby 8y ago
  Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same locked container as the passowords"? Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?
  - icebraining 8y ago
    Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.
    - dontbenebby 8y ago
      > Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place. Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too. (I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )
nucleardog 8y ago
This is why I refuse to upgrade from 1Password 4. Or switch to another product. I haven't found anything that I can self-host and allows me to have multiple "vaults". And I refuse to keep all my 2FA codes and recovery codes in the same place as the passwords, since that completely defeats the point. When I asked 1Password about it, their response was that the functionality wouldn't be coming back in 7 because it wasn't a supported configuration -- it's called 1Password so users should only ever be remembering one password! If Keepass's entire UX wasn't hot garbage it would be perfect. But here we are.
- pmoriarty 8y ago
  Have you tried KeepassXC? It can do this, and I don't see anything remotely resembling "hot garbage" in its UX. https://keepassxc.org https://keepassxc.org
  - oarsinsync 8y ago
    I use this as well as 1Password. I'd describe the UX generally as being 'hot garbage' compared to 1Password. The difference in polish is night and day. That said, based on this report, the security model is significantly better, so the decision becomes do I care more about usability/being pretty, or security. The never-ending trade-of between security and usability continues...
- captn3m0 8y ago
  I use pass with multiple vaults. Not the same 2 vaults as you want, but I run one "everything" vault, and another one for just "mobile". The "mobile-passwords" git repo doesn't have any password I don't use on my phone.
- dontbenebby 8y ago
  >I haven't found anything that I can self-host and allows me to have multiple "vaults". I'm not familiar with 1Password. How do you access these various "vaults" - you type a password, correct? I guess I'm not following why multiple Keypass DBs with multiple passphrases is not acceptable for you, but several passwords in one app is? (To be clear, I'm not saying your opinion is wrong I just want to understand - usable security is an interest of mine :) )

Don’t you also store the 2FA recovery codes in the PW manager though? I haven’t found any other good method for this other than printing them out but that comes with its own issues obviously.

akerl_ 8y ago

No, for exactly this reason. My recovery codes are on index cards in a physical safe, and then I've got MFA via multiple devices (TOTP on Phone + yubikey for most things).

dontbenebby 8y ago
Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same locked container as the passowords"? Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?
- icebraining 8y ago
  Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.
  - dontbenebby 8y ago
    > Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place. Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too. (I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )

nucleardog 8y ago

This is why I refuse to upgrade from 1Password 4. Or switch to another product. I haven't found anything that I can self-host and allows me to have multiple "vaults". And I refuse to keep all my 2FA codes and recovery codes in the same place as the passwords, since that completely defeats the point. When I asked 1Password about it, their response was that the functionality wouldn't be coming back in 7 because it wasn't a supported configuration -- it's called 1Password so users should only ever be remembering one password! If Keepass's entire UX wasn't hot garbage it would be perfect. But here we are.

pmoriarty 8y ago
Have you tried KeepassXC? It can do this, and I don't see anything remotely resembling "hot garbage" in its UX. https://keepassxc.org https://keepassxc.org
- oarsinsync 8y ago
  I use this as well as 1Password. I'd describe the UX generally as being 'hot garbage' compared to 1Password. The difference in polish is night and day. That said, based on this report, the security model is significantly better, so the decision becomes do I care more about usability/being pretty, or security. The never-ending trade-of between security and usability continues...
captn3m0 8y ago
I use pass with multiple vaults. Not the same 2 vaults as you want, but I run one "everything" vault, and another one for just "mobile". The "mobile-passwords" git repo doesn't have any password I don't use on my phone.
dontbenebby 8y ago
>I haven't found anything that I can self-host and allows me to have multiple "vaults". I'm not familiar with 1Password. How do you access these various "vaults" - you type a password, correct? I guess I'm not following why multiple Keypass DBs with multiple passphrases is not acceptable for you, but several passwords in one app is? (To be clear, I'm not saying your opinion is wrong I just want to understand - usable security is an interest of mine :) )