this post was submitted on 09 Sep 2023
257 points (96.1% liked)

Privacy

32456 readers
522 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] flumph 2 points 1 year ago (2 children)

I'm curious about using the same store for passwords and TOTP. Technically if someone gets screwed to your database, they have both your factors, yes? But I guess it does thwart someone trying to brute force your password.

[–] [email protected] 3 points 1 year ago* (last edited 1 year ago) (1 children)

Adding a hardware key, like Nitrokey, would be an additional level of safety there. I would not use the database without some kind of additional key (something you know and something you physically have).

If there's something nefarious that has user access, you've already lost in that regard.

[–] [email protected] 3 points 1 year ago (1 children)

Just to add, you can also use multiple databases to help maintain separation

[–] [email protected] 2 points 1 year ago

This is what I do: I have 3 KeepassXC databases (regular passwords, "security" questions, TOTP tokens) each with a different password.

[–] [email protected] 1 points 1 year ago

Technically you do lose the second factor, but nowadays 2FA is often mandatory or they force some crap like SMS/email verification onto you. If you are aware of the risk then it isn't a huge deal.

Though you might want to consider not using it at least for the most important stuff like banking (here you don't even have an option; banks have their own 2FA apps that you have to use) and primary/recovery email.