0

I'm planning on using KeePass XC for the first time and am trying to create a setup that:

(1) would prevent hackers from stealing my passwords

(2) would prevent me from losing access to my passwords

My password management setup is written below. Currently, my weakest point of attack is if someone steals my USB.
  • I use Keepass XC.
  • I use TOTP 2FA via Keepass XC.
  • I make backups in 2 separate USB drives.
  • I have the Keepass database stored on my computer and access it using a keyfile stored on my USB.

USB x2 (What I store in my USB)

  1. db

  2. db keyfile

  3. db master pw

  4. export file of all account credentials and totp codes in my keepass database

blueherron
  • 1
  • 1
  • What is your threat model? Do you want to protect yourself against state sponsored agencies? Friends and family? Business competitors? Depending on the threat, what is acceptable or not for you may vary. – Yuriko Aug 28 '22 at 07:59

1 Answers1

0

Full disclosure is more opinion than fact: (I used KeyPass/XC for a few years, but switch to a different service due to sync difficulty)

Your risk tolerance is really based on your own comfort level and personal threat level. If you are a high-value target this conversation would be different.

In General, having 2 or more backups is good, BUT all in the same space is bad. Off-site backups are important, but then you need to trust the offsite location. Second is the need to sync, a backup database that out of date is not too helpful. So syncing will be an issue and difficult if the off-site copy is in a bank vault for example.

Assuming Windows pc with a not high-value target, modist risk. I would recommend:

  • Store one of the vaults in a trusted/one you comfortable with cloud storage (this solves the offsite need).

  • Keep the master password and key file (if applicable) out of the cloud storage. (cloud storage user cannot decrypt if storage is not the key file isn't accessible.) Alternatively, there is a phone app option.

  • keep another DB/key file on a USB stick ( the master password stay separate)
    • this allows you to have the password on go (if stolen/lost they still need master password). If really paranoid, you can get a pin protected USB, but that more to remember.
  • You may not want to store the totp data with the keypassxc database. Save in a phone app like authy?
  • Building off of another question increasing iteration and using a strong master password will make brute force harder, though slow down the app.
  • As for the sync issue, I did it manually, there is a feature called keeshare, that offers sync options, however I could only find docs in the beta page, so it's functionally/stability may be limited.
  • Finally, there is no perfect security, it all about trade-off and risks
Super Nerd
  • 158
  • 5