Comment on More than $35 million has been stolen from over 150 victims since December — ‘nearly every victim’ was a LastPass user

• lazynooblet@lazysoci.al ⁨1⁩ ⁨year⁩ ago

  Absolutely, Keepass is a great alternative to cloud managed password managers.

  You are also vulnerable to keyloggers or clipboard captures

  Keepass (and most password managers) are vulnerable to this as well.

  source

  • Rootiest@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Keepass (and most password managers) are vulnerable to this as well.

    Not if you use the browser extension

    Plus it does automatically clear the clipboard after a short time which isn’t perfect but it’s still an improvement over using a text file

    source
  • jarfil@lemmy.world ⁨1⁩ ⁨year⁩ ago

    True, but KeePass has some countermeasures, like wiping the clipboard after some time, sending the password directly to a browser extension, or entering the master password on a “secure desktop” (technically not all that secure, but more secure than the lack of it).

    source
• charles@lemmy.world ⁨1⁩ ⁨year⁩ ago

  Is there a recovery process if your yubikey breaks?

  source

  • Rootiest@lemm.ee ⁨1⁩ ⁨year⁩ ago

    Having a recovery process for the YubiKey world really just be a potential security hole.

    Ideally you have a backup clone of the key in case yours is lost/broken.

    Keeping a recovery seed or backup password instead would be inherently less secure as the YubiKey uses an HMAC challenge-response key for KeePass rather than a static password/key file.

    A static password or key would be a better target for hackers as it would be easier to crack so having that option would lower your overall security.

    source

    • Professor_Piddles@sh.itjust.works ⁨1⁩ ⁨year⁩ ago

      Thank you for your detailed responses - I’m going to look into KeePass and maybe a Yubikey after reading your description of how it works. I hadn’t considered a Yubikey before mostly because I’m prone to lose things, but also because my encrypted file password is >12 characters and a fairly random mix of lower and uppercase letters, numbers and special characters.

      source
  • PlexSheep@feddit.de ⁨1⁩ ⁨year⁩ ago

    There is no recovery if you have a single hardware token in use only. But that’s a structional issue with your concept.

    Instead, it is recommended to have two (or more) identical Hardware Tokens to replace one that dies.

    It is also smart to keep the seeds for things like 2fa in some secure backup with schizophrenic paranoia proof Security measures.

    source