Being privacy-aware in 2016

Re:Being privacy-aware in 2016 by fauigerzigerk on Monday June 06, 2016 @11:25AM (#11847443)

Why is it a good idea to use a key file instead of a password? Any malware I catch could use the key file to access all my passwords or is there something I'm not understanding?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by ahartman00 on Monday June 06, 2016 @04:47PM (#11850212)

I'd recommend both, keepass supports that. Keepass supports using a secure desktop to prevent keyloggers[1], but you never know with some of the usb keyboard exploits[2], and good old fashioned looking over your shoulder. While keepass has protection against dictionary attacks[3], why not use a keyfile? you can put it on a flash drive, and now noone can access your passwords without that usb key. (obviously make sure you have multiple copies of your keyfile :)

1. http://keepass.info/help/base/security.html#secdesktop 2. http://arstechnica.com/security/2014/07/this-thumbdrive-hack... 3. http://keepass.info/help/base/security.html#secdictprotect

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by fauigerzigerk on Tuesday June 07, 2016 @03:53AM (#11853034)

>why not use a keyfile?

Because you're always just one burglary away from passwordocalypse?

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by giancarlostoro on Monday June 06, 2016 @02:05PM (#11848856)

I would personally use a combination of both. If you keep the key file on a USB thumb drive that you only insert when you need to unlock your files I guess it works out well then.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by fauigerzigerk on Monday June 06, 2016 @03:00PM (#11849348)

That sounds like a better idea, but I still don't really see the upside as compared to remembering one long passphrase.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by jwives on Monday June 06, 2016 @05:25PM (#11850537)

I use a combination of password and key file so that I can worry less about someone shoulder surfing or otherwise observing the input of my password.

My password database is stored on a USB key that I carry with me, with a regular copy made and securely stored.

Key file is stored on devices I use, in a directory restricted to my own access and on a drive which is encrypted. An encrypted copy is also stored on the USB key with the password database; this can be decrypted using a GPG, key stored on a yubikey and also carried; if a device can be trusted enough, this is how I move the key file around.

Access to the database requires 3 things rather than two. A long passphrase could be recorded by an observer, who could then take my USB key. The key file ensures that they still do not have all that they need.

[ Parent | on HN ]

Re:Being privacy-aware in 2016 by giancarlostoro on Tuesday June 07, 2016 @07:19PM (#11858829)

The idea is, if the <attacker> doesn't have the key file, it doesn't matter what password they try, they wont get in.

[ Parent | on HN ]