• thisisawayoflife@lemmy.world
    link
    fedilink
    arrow-up
    49
    ·
    1 year ago

    Been using KeePassXC (and before that, KeePassX) since I abandoned LastPass about a decade ago. The apps integrate with Nextcloud perfectly and at least for me, it’s a breeze. I use it for TOTP too, and I second the recommendation of a hardware token for an additional layer of security. There are some USBc options that work on phones (I’m using a pixel 7 pro).

    • FlumPHP@programming.dev
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      I’m curious about using the same store for passwords and TOTP. Technically if someone gets screwed to your database, they have both your factors, yes? But I guess it does thwart someone trying to brute force your password.

      • thisisawayoflife@lemmy.world
        link
        fedilink
        arrow-up
        3
        ·
        edit-2
        1 year ago

        Adding a hardware key, like Nitrokey, would be an additional level of safety there. I would not use the database without some kind of additional key (something you know and something you physically have).

        If there’s something nefarious that has user access, you’ve already lost in that regard.

          • rinze@infosec.pub
            link
            fedilink
            arrow-up
            2
            ·
            1 year ago

            This is what I do: I have 3 KeepassXC databases (regular passwords, “security” questions, TOTP tokens) each with a different password.

      • Amju Wolf@pawb.social
        link
        fedilink
        English
        arrow-up
        1
        ·
        1 year ago

        Technically you do lose the second factor, but nowadays 2FA is often mandatory or they force some crap like SMS/email verification onto you. If you are aware of the risk then it isn’t a huge deal.

        Though you might want to consider not using it at least for the most important stuff like banking (here you don’t even have an option; banks have their own 2FA apps that you have to use) and primary/recovery email.