Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePassXC 2.2.0 released with YubiKey and TOTP support

keepassxc.org

Post reply on HN
Print view View original

51–60 of 132 posts

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#51

Post by rajivm »

davchana wrote: post #38
tedd4u wrote: post #34

Earlier quoted context omitted.

Keep 1 key on your keychain, one in a fire vault in the house, and one in the safety-deposit box at the local branch bank office. Most U2F-enabled sites let you register multiple keys. Add new sites with keychain during the day, in the evening add the fire-vault key at home. Once a quarter add the third key from the safety-deposit box.

Why specifically during day/evening/quarter? Why not all three at same time? Just asking. Thanks..

Because you need the key with you to register it with a site, and if they are being stored in separate locations, you need to do it when you have access.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#52

Post by secfirstmd »

interfixus wrote: post #18
droidmonkey wrote: post #5

Earlier quoted context omitted.

Wow thank you for the kind words! Appreciate the support.

You're welcome, it's a very decent effort. And now I'm sort of shamed into actually contributing. Reporting back as soon as time allows.

Yep we are now switching to advising its use for the human rights defenders and journalists that we work with.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#53

Post by pacomerh »

TokenDiversity wrote: post #39

Features I like: 1) Download website favicon (no clue how though, tried entering website but didn't see an option to download favicon) 2) Command line interface, no clue again how to use.

Indeed, wish there was more documentation on how to use the CLI

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#56

Post by pfg »

problems wrote: post #44
ktta wrote: post #42

Notable features: 1. Unlock using Yubikey 2. TOTP 2FA 3. Diceware password generator 4. ASLR for in-memory security (didn't expect this!) 5. Portable and Single instance mode (I'll have to check this one in detail) Thanks for your work team!

For anyone wondering - the TOTP 2FA is not on the password wallet itself, but that the wallet is able to store the TOTP key, authenticating TOTP involves knowing the key, by which point there's really no value in using it to authenticate the wallet, it'd be a UI-only protection. However I think storing TOTP keys in your wallet is a bad idea for security - now if someone hacks your machine they get both your password…

Just to make sure no one gets the wrong impression: You still have a single point of compromise, as having sufficient access to your machine would allow an attacker to do anything from intercepting your TOTP code to stealing your session or just sending requests from your device. U2F doesn't help with this aspect either, it just adds phishing resistance.

The difference lies in the amount of effort an attacker would have to go through. A compromised password manager database including TOTP secrets effectively gives them access to everything at once, whereas any other kind of compromise would require a lot more effort to get everything, and would probably increase the odds of detection.

It's also a good way to hedge against types of compromise where only your password manager is affected, from vulnerable browser extensions (see LastPass, among others) to the possibility of weak crypto (which would be especially devastating for password managers that use centralized online storage) or even backdoors.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#57

Post by unsignedint »

sayright wrote: post #55

Storing password and TOTP seed in a single storage goes against the concept of 2FA.

Well instead general password without password manager assumes the fact someone remembers that password. (and perhaps reusing that password.) Using password manager (with different password for each service) plus TOTP would serve its purpose. You still have to enter the code, so it still require you to "have" that code somehow which makes it no different than provisioning multiple devices which many 2FA systems won't prevent, perhaps other than hardware TOTP devices.

Re: KeePassXC 2.2.0 released with YubiKey and TOTP support

#59

Post by th3zero »

problems wrote: post #44
ktta wrote: post #42

Notable features: 1. Unlock using Yubikey 2. TOTP 2FA 3. Diceware password generator 4. ASLR for in-memory security (didn't expect this!) 5. Portable and Single instance mode (I'll have to check this one in detail) Thanks for your work team!

For anyone wondering - the TOTP 2FA is not on the password wallet itself, but that the wallet is able to store the TOTP key, authenticating TOTP involves knowing the key, by which point there's really no value in using it to authenticate the wallet, it'd be a UI-only protection. However I think storing TOTP keys in your wallet is a bad idea for security - now if someone hacks your machine they get both your password…

Just to make sure no one gets the wrong impression: You should store your TOTP keys in a different KDBX file, locked with a different master password, and maybe even used on a different device/PC.

We all know that you shouldn't store your password along with TOTP secrets, or should I make a blog post explaining this?

Post reply on HN