Hacker News Reader

Comment by Timber-6539 | Hacker News Reader

1. You can store your encrypted KeepassXC kdbx file anywhere you wish.

2. KeepassXC has a browser extension.

3. Refer to point 1.

4. Using a keyfile is optional and IMO don't see how it adds any security benefits to the master passphrase.

The only reason Bitwarden "just opens" from the last session is because of the very features you have disabled in KeepassXC (remember last used kdbx).

Launching KeepassXC for me has exactly the same steps as Bitwarden has. Open program, put correct passphrase (or insecure PIN on Bitwarden for the lazy folks) and the password database unlocks.

View on HN

> 4. Using a keyfile is optional and IMO don't see how it adds any security benefits to the master passphrase.

I believe it fulfills the same 2FA role as does the Secret Key in 1Password <https://support.1password.com/secret-key-security/>: combining something you know (passphrase) with something you have (keyfile/Secret Key), thus making a potential Dropbox breach (or wherever you store your .kdbx) not subject to offline dictionary attacks -- err, unless you also stored your keyfile in Dropbox in which case, yes, it wouldn't add any security benefits

A strong passphrase should be good enough to deter dictionary attacks, even if your kdbx file is leaked.

And even then the ciphers used to encrypt the kdbx file are highly configurable, you can future-proof the key derivation function as much as your hardware can reasonably afford to unlock the file.

Besides using a keyfile for daily use is impractical. For correct usage, you'd have to keep it in a separate drive from your kdbx (in a USB flash perhaps), as you very well mentioned. But then in the menu you'd have to go to the directory the keyfile is stored in every single time you want to unlock your database if am not mistaken about how the feature works on KeepassXC.

KeePassXC even had the advantage that I only have to unlock once for both desktop app and browser extension.

BitWarden requires separate unlocks.

Reply on news.ycombinator.com