4 ms·
An adversary still has to get the manager DB and the key to unlock it (your password manager DB is encrypted with a key, right?).
by Godel_unicode 5y ago
An adversary still has to get the manager DB and the key to unlock it (your password manager DB is encrypted with a key, right?).
- willis936 5y agoWhat's the point of using a key? That doesn't add a second factor of authentication. Something you have and something else you have is 1FA. A password with more than 200 bits of entropy seems reasonable.
- maxerickson 5y agoThey key doesn't particularly increase the security of the authentication, but it helps a bit if you lose control of the device the db is stored on.
- willis936 5y agoYeah but a key without a second factor (something you know) is still better than a key. Just make sure your password isn't brute forceable.
- Godel_unicode 5y agoFirstly, while that's technically correct according to the CISSP, it's obviously not actually correct. Two different things I have can absolutely be two factors as long as they are not susceptible to the same method of compromise. 1+1=2. Secondly, many password vaults refer to the master password you use to unlock it as the key. Thirdly, many security keys require a pin or similar to be used.