3 ms·
Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same l
by dontbenebby 8y ago
Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same locked container as the passowords"?
Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?
- icebraining 8y agoSeems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.
- dontbenebby 8y ago> Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place. Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too. (I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )