Been using KeePassXC (and before that, KeePassX) since I abandoned LastPass about a decade ago. The apps integrate with Nextcloud perfectly and at least for me, it’s a breeze. I use it for TOTP too, and I second the recommendation of a hardware token for an additional layer of security. There are some USBc options that work on phones (I’m using a pixel 7 pro).
I like the look of KeePassDX but I was bothered by the fact that I have to use the yubikey every single time to unlock the database, unlike keepass2android which allows me to store the yubikey credential with biometric lock until the phone restarts. Keepass2android is not as nice of an app but that feature was really required for me.
its not a huge issue on KeePassXC because I keep a yubikey nano plugged into my laptop, but for my phone, I haven’t been able to make this work reliably with KeePassDX. I’ll have to give it another go.
I’m curious about using the same store for passwords and TOTP. Technically if someone gets screwed to your database, they have both your factors, yes? But I guess it does thwart someone trying to brute force your password.
Adding a hardware key, like Nitrokey, would be an additional level of safety there. I would not use the database without some kind of additional key (something you know and something you physically have).
If there’s something nefarious that has user access, you’ve already lost in that regard.
Technically you do lose the second factor, but nowadays 2FA is often mandatory or they force some crap like SMS/email verification onto you. If you are aware of the risk then it isn’t a huge deal.
Though you might want to consider not using it at least for the most important stuff like banking (here you don’t even have an option; banks have their own 2FA apps that you have to use) and primary/recovery email.
Been using KeePassXC (and before that, KeePassX) since I abandoned LastPass about a decade ago. The apps integrate with Nextcloud perfectly and at least for me, it’s a breeze. I use it for TOTP too, and I second the recommendation of a hardware token for an additional layer of security. There are some USBc options that work on phones (I’m using a pixel 7 pro).
yup, no need to pay for a password manager. and far more secure.
I never got YubiKey to work on desktop with it. Key files seem to work good enough and easy to manage.
YubiKey works for me, both on desktop with KeePassXC and on Android with KeePassDX to the same DB
I like the look of KeePassDX but I was bothered by the fact that I have to use the yubikey every single time to unlock the database, unlike keepass2android which allows me to store the yubikey credential with biometric lock until the phone restarts. Keepass2android is not as nice of an app but that feature was really required for me.
KeepPassXC can do this as well, but it does require the yubikey to be inserted every time you want to save a change to the database.
Look under Settings -> Security -> Convenience -> Enable database quick unlock (Touch ID/Windows Hello)
Using that I can quick-unlock my database using my laptop’s fingerprint scanner, just like how KeepPassDX works on Android.
its not a huge issue on KeePassXC because I keep a yubikey nano plugged into my laptop, but for my phone, I haven’t been able to make this work reliably with KeePassDX. I’ll have to give it another go.
Ah yeah you are right, it makes me tap my key every time I open the app.
The biometrics seem to only replace the master password.
I do wish it worked more like KeePassXC where the key is only needed to save the database after unlocking and confirming with fingerprint
It does require some configuration within yubikey manager. I did not find it straightforward but once set up its really reliable.
While we’re on the topic of open source products, may I suggest the SoloKey:
https://solokeys.com
So it’s like a YubiKey?
Yes, same type of device.
I’m curious about using the same store for passwords and TOTP. Technically if someone gets screwed to your database, they have both your factors, yes? But I guess it does thwart someone trying to brute force your password.
Adding a hardware key, like Nitrokey, would be an additional level of safety there. I would not use the database without some kind of additional key (something you know and something you physically have).
If there’s something nefarious that has user access, you’ve already lost in that regard.
Just to add, you can also use multiple databases to help maintain separation
This is what I do: I have 3 KeepassXC databases (regular passwords, “security” questions, TOTP tokens) each with a different password.
Technically you do lose the second factor, but nowadays 2FA is often mandatory or they force some crap like SMS/email verification onto you. If you are aware of the risk then it isn’t a huge deal.
Though you might want to consider not using it at least for the most important stuff like banking (here you don’t even have an option; banks have their own 2FA apps that you have to use) and primary/recovery email.