How do you manage your KeePass databases and password?

Hi recently I switched from my old bad habit of reusing the same password on all sites to using a password managemer. I chose to use KeePass, because most other options are either proprietary or a cloud hosted service, which is a great target for hackers. But I don't know how to manage my databases efficiently. And interested to see how others do it. In the setup I use right now, I have two databases, one for passwords and one for my 2FA backup code, I use KeePassXC on my desktop and KeePassDX on my Android, I sync the databases peer to peer using synching. And just in case I somehow lost both devices I keep a backup of these databases in a two separate cloud account. So in general I have to remember 4 passwords. 2 for the KeePass databases And 2 for the cloud Accounts

database on nextcloud key locally on all my devices 80+ character password

>But I don't know how to manage my databases efficiently. And interested to see how others do it. Neither I do My strategy One KeePassXC database on my computer which is used for logging into online account. Many other KeePassXC databases on same computer, not used. It is good to keep copies of your vault in case you fuarrrk it up. Few copies in secure offsite locations, in case of natural disaster, robbery, etc. I do use an four word diceware password, it is good by now but no means future proof. I tend to avoid cloud services, currently I only know two passwords, my FDE five word diceware password and password vault password.

One passphrase for disk encryption to remember and one detached key file to carry on a thumbdrive. I use my password manager on this computer only, there's no need for additional authentication since I'm pretty much the only person who is allowed to touch it. Don't use NSA/Google personal trackers, your problem solved.

I use keepassxc. Database stored on an usb key. (NEVER in the cloud, NEVER locally). Additionally a portable version of keepass (for window$) and an .appimage if I need to use it on some other machine. A copy on an encrypted disk hidden somewhere if (when) soykaf will hit the fan. minimum 37 charachters (including ASCII).

>>11618 >Additionally a portable version of keepass (for window$) and an .appimage if I need to use it on some other machine. I NEVER NEVER NEVER unlock my database on a computer I don't own. You never know what's in your grandma's computer. Always keep, a portable live Linux USB to boot from it when needed, I usually use Tails.

>>11612 I sync the database between the 4 devices I own with syncthing, never had an issue so far. Also I used to have a key with a portable OS because of this >>11623 Other computers are too cyberhumped even by phone standards.

>>11623 >Always keep, a portable live Linux USB to boot from it when needed, I usually use Tails. Honestly I never used it on a computer I don't own, but if needed it would be on a friend/family one, but you're totally right. Will reconsider it.

DB stored on Nextcloud, synced between four devices. It also makes a copy any time there is a change, so I potentially have multiple copies to work with in the case of corruption or something going awry. I back it up and maintain it offsite, offline. Currently using KeePassXC and Keepass2Android for mobile access. Would love to experiment with the use of a hardware key once I'm confident I can recover in the event of a destroyed/lost/stolen key.

>>11612 i use pass. it reads and writes to gpg-encrypted files (one for each login). just copy the folder and your keys to a usb or something.

>>11662 The nice thing about pass is it works pretty much everywhere you can run pgp, and the syncing problem is solved by storing passwords in a git repo. Keepass is arguable a better password manager but I ended up switching to pass for those reasons.

>>11629 Pretty much the exact same set-up I use.

>>11662 >>11664 > With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities. Wait, so the folder structure and password entry names are in plaintext, just the contents are encrypted? I must be misunderstanding something, right?

>>11686 No that's right, and is the main criticism people have of pass. You can of course just store the whole thing in an encrypted volume though. I don't do that but I probably will at some point.

>>11688 it's pretty much useless then

>>11690 ...if hiding which accounts you own is part of your threat model I guess?

Keep a database in home holder. Periodically make backups to various drives. Password is never used online. Keyfile stored only on flash drive and backed up on drives other than database backups. If I need to access a password, I inser the flashdrive, then immediately close and unmount drive

>>11690 i mean you can name the filename whatever you want. you don't necessarily have to name it "gmail.com" for example, you could name it "mail".

>>11696 To be fair, the scripts it uses tend to assume the files are named "username.gpg" for things like form autofill so there's some resistance to doing things that way that wouldn't be there with keepass. Really just depends on your threat model and what other precautions you've taken to secure your filesystem.

old encrypted cellphone in my pocket, with radio partition destroyed, wifi/bluetooth/ir/nf/usb etc frozen or disabled. perfect secure, airgapped pocket computer.

>>11698 That means you have to type your passwords though. Do you still use long randomly generated passwords for each account? I feel like it'd get annoying really quickly unless you rely on your browser's password db which kind of defeats the point.

>>11699 i use the passphrase paradigm of long, random strings of dictionary words. that allows typing the whole thing from a short glance, and still provides plenty of entropy. in especially sensitive situations, i click them into an onscreen keyboard, which mitigates keylogging attacks. and i don't even use a password app, just an encrypted text file. "kiss" ftw.

>>11698 Technically speaking, it's not airgapped if it has radio circuitry. And not exactly perfect since phone operating systems get obsolete and gain vulnerabilities too fast. Is there even an option to use proper LUKS on recent Androids instead of weakened file-based encryption? >>11699 I know it's not possible with current dumbed-down smartphones, but a small computer device could theoretically present itself as USB keyboard, and send keystrokes from it's password database.

>>11721 >small computer device could theoretically present itself as USB keyboard That's an interesting idea. Would be a nice feature to build into one of those hardware key things.

I don't want to make a new thread for this but I've been using KeePass for a long time since I used to be very paranoid. KeePass is starting to prove to be very annoying since I actually do work now so I'm very tempted to use Bitwarden for the features included in modern cloud based password managers. Everything about it just seems so damn perfect, I can't find a single security flaw from the FAQs I've read. So is it a good idea? I just want to make sure I don't regret uploading my all my passcodes to someone's cloud.

>>11746 >features included in modern cloud based password managers Like what? Its pretty trivial to sync a password db file between two or more computers. I cant imagine what else you would need.

>>11747 >I cant imagine what else you would need create a weak point to intercept and steal all your passwords, that's what all these services do

>>11747 Effortless sync and easy access from anywhere is the biggest reason. With KeePass I had to put a lot of effort into syncing databases which wasn't worth the time. But you're right then, I suppose. I don't have the time or sanity for KeePass anymore so I'd really like Bitwarden. It's so tempting

>>11749 Can't you just throw it in a syncthing directory or something?

>>11750 Exactly what I did, I don't always have access to the devices with the more recent database though or a way to sync them when offline one of the devices are offline if that makes sense.

>>11751 I'll tell you my setup, maybe it'll give you some ideas. I use gnu pass, which stores passwords in a git repo so syncing is somewhat manual but easy enough to manage since it just uses ssh keys (even though I make new accounts pretty often). I keep a local branch on each device to add new keys and merge them into master when I push but that's probably not actually necessary. I just find it helps with organization and I'm fairly comfortable with git so it isn't much of an additional mental load. The "origin" is stored on a file server on my home network, which is always accessible to me over a VPN (which sounds like the missing link in your setup). The VPN was annoying to use when I had openvpn because it would randomly fail to connect and end up in weird bugged states that required manual intervention but once I switched to wireguard it became a lot more stable and most of the time I forget its even running. As for integration with browsers and whatnot there's a nice Firefox plugin that does form autofill. For other kinds of passwords (mostly to unlock keys and whatnot) I use a simple dmenu interactive prompt script thing I wrote and tied to a keyboard shortcut. Getting passwords on my phone is a bit more tedious but there's a pretty good app in fdroid called "password store" which is just a nice UI for gnu pass. You have to paste passwords in manually though. Its not a huge deal because I don't actually use my phone much but if I did I'd probably make use of my browsers password db thing and just use the app to get new passwords when they change. In theory you can also just use the browser plugin I mentioned on your phone but it requires a functional gpg installation and some additional tooling outside the browser so I haven't bothered fuarrrking around with it. The UI wouldn't be very good for touch screen operation anyway.

I use firefox lockwise, its not the best but it gets the job done ... for now. I remember Ubuntu used to come with a password manager, not sure how safe it is tho

>>11612 Brain.exe It's the most effective password storage.

>>12049 Here's hoping you don't have faulty meatware. Even without the weird random soykaf that can go awry biologically, all it takes is one accident to lose everything. Strongly suggest you have some kind of backup.

>>11740 I shouldn't tell people this but I keep my every day use keystore pass assigned to a programmable hardware key. I've been thinking of getting a more advanced programmable keyboard so that the master pass can use a key combo. I've also considered building a bluetooth HID device that types this password.

>>11747 So to answer this I've lost keypass databases to corruption which can be remedied with replication. But that becomes a mission critical service to support in my off time. When I lost my keypass database my work just happened to be switching to 1pass and I needed it for shared corporate passwords. They gave me a free personal account which I was suspicious of but did some research, don't remember what I found but it was good enough for my threat model. I now use 1password for day to day use and use keypass for things that I don't need as often and that need to stay more secure. Finally for very secure things I have a script that uses both key stores and an additional key to get the key but I have yet to need it.

>>11750 >syncthing Oh wow nice dude!! I'm totally going to start using this and keypass when my 1password account expires. One quick question though. I want to store my passwords on the cloud and use that as the source of truth. Will I be able to do this with out allowing some ingress to my home network?

>>12516 Sorry for the double posting but this is just freaking fantastic! fuarrrk cloud storage I'll do my phone, my mirrored, backed up NAS, and my gaming PC and put my relay out on a cloud provider. >Even though the relay could be used for man-in-the-middle attack, using TLS at the application/BEP level ensures that all the traffic is safely encrypted, and is completely meaningless to the relay. Furthermore, the secure suite of ciphers used by BEP provides forward secrecy, meaning that even if the relay did capture all the traffic, and even if the attacker did get their hands on the device keys, they would still not be able to recover/decrypt any traffic which was transported via the relay.

>>12514 >I've been thinking of getting a more advanced programmable keyboard so that the master pass can use a key combo. This would allow your master pass to be long and difficult to type, but I wonder if there are ways to make it more secure than literally having your master pass compiled in to the keyboard firmware. Perhaps the master pass could be encrypted with or derived from a PIN you enter on the numpad or something. Although there isn't really much of a point in doing this since you already have a hardware key which can be secured with a simple pin. I guess the advantage would be that if you have a long annoying master pass memorized you could bring the key with you for when you need to have your passwords available away from home, but when you're at your desk you can use the shorter PIN (this could be achieved with two hardware keys, but then you'd have to keep them in sync).

Not using KeePass, but I'm using Bitwarden. I'm starting to feel like switching away from Bitwarden to KeePass as Bitwarden doesn't have an extension for Pale Moon. My current situation is stopping me from switching away from Bitwarden to KeePass.

>>11612 I just plop my database in the Google drive connected to my phone It's heavily encrypted and locked with a keyfile and 20+ character pass so there ain't no real risk in putting it there

>>12518 > Perhaps the master pass could be encrypted with or derived from a PIN you enter on the numpad or something. Problem is my programmable keyboard would need to be more advanced than it is or my password management tools would need to be more flexible than they are. Making them such is possible but would mean a massive loss of convenience. The easiest thing would be to replace my keyboard but I don't want to replace a perfectly good keyboard right now. I do know my master passwords but they're super fuarrrking long and it gets tiring to type them at machines I use often. I think the solution will be a passthrough keyboard emulation device, several have been based on popular SBCs like the arduino. I've also considered a bluetooth HID device but I know it's likely going to be annoying to constantly re-pair and keep charged plus the arduino option will allow me to add so much more security where the HID option will still have the problem where someone pushes a single button in a text editor and gets to see my whole password.

Syncthing always