3 ms·

2FA is engaged at the authentication stage, so knowing the vault passphrase may not be sufficient. Further, allowing anyone to download my encrypted vault just

• lisper 5y ago
  You can use 2FA to encrypt. OK, it would be 2FE, not 2FA, but it's the same idea. Just encrypt using a Diffie-Helman key derived from a secret contained on a device. (Of course, if you're going to do this, you could just as well keep the vault itself on the device.) > Further, allowing anyone to download my encrypted vault just feels really uncomfortable and unnecessary. It is unnecessary. I said you could publish your vault on github and still be more secure than a third-party provider. I didn't say you should do this. Of course you should try to keep your vault away from prying eyes. But you should not rely on this for your security. You should only ever rely on one thing for data security, and that is the integrity of your secrets, which should be small enough to be stored in your brain or in a device that allows them to be used without being read (2FA/E). That's the whole point of encryption.