3 ms·

While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's

While it's definitely more work to setup, I've been using KeePassXC + NextCloud for syncing. I've got it working on my phone with keepass2android (think that's the name) and also use a yubikey challenge-response key to help ensure that even with a bad password i've got decent protection of my passwords. There's browser extensions for basically every browser out there, and it even supports auto-typing into non-browser based applications (though I can't say I use that feature myself).

acidburnNSA 7y ago
I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?
- simcop2387 7y ago
  Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress. They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.
  - simcop2387 7y ago
    Forgot to mention, the syncing is all done via Nextcloud (open source dropbox like system, but also does a lot more).

acidburnNSA 7y ago

I've been using something very similar, though I only have a local keyfile that I independently put on my synced machines rather than the yubikey thing. How do you like the yubikey process? Not too much of a pain?

simcop2387 7y ago
Not much of an issue at all, it does mean that when i need to unlock my manager or save the database, i have to have my [physical] keys around but it's otherwise not an issue. I've got two duplicated yubikeys for it, a neo with nfc and a 5 with usb-c. I generally use the neo for everything but needed the usb-c one for laptops with no USB-A ports and my tablet which also has no USB-A or NFC. Just the march of progress. They get used by KeePassXC in yubico challenge-response mode, which I believe works as follows, take the HMAC(KDF(password), nonce) and use it as the challenge to the yubikey, and the response that's returned is the master key for the database. That's why it needs the yubikey whenever you save the database and open it, as it generates a new nonce each time. It's still vulnerable to a playback attack if someone recorded the interaction and had that exact copy of the database but that's also still true of one protected without it. But with that, they have to get both of them at the same time, an old copy of the database can't be attacked by a different challenge/response than the one it was secured with. I used to use the keys in HOTP mode for this with KeePassX before KeePassXC supported this mode, but that made for an easier to attack setup since there needed to be a copy of things to predict what the OTPs being generated would be. This also made syncing a lot harder because there was an additional state file that was re-generated every time the database was unlocked.
- simcop2387 7y ago
  Forgot to mention, the syncing is all done via Nextcloud (open source dropbox like system, but also does a lot more).