My recovery codes are on index cards in a physical safe, and then I've got MFA via multiple devices (TOTP on Phone + yubikey for most things).
Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?
Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too.
(I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )
I haven't found anything that I can self-host and allows me to have multiple "vaults". And I refuse to keep all my 2FA codes and recovery codes in the same place as the passwords, since that completely defeats the point.
When I asked 1Password about it, their response was that the functionality wouldn't be coming back in 7 because it wasn't a supported configuration -- it's called 1Password so users should only ever be remembering one password!
If Keepass's entire UX wasn't hot garbage it would be perfect. But here we are.
It can do this, and I don't see anything remotely resembling "hot garbage" in its UX.
That said, based on this report, the security model is significantly better, so the decision becomes do I care more about usability/being pretty, or security.
The never-ending trade-of between security and usability continues...
I'm not familiar with 1Password. How do you access these various "vaults" - you type a password, correct?
I guess I'm not following why multiple Keypass DBs with multiple passphrases is not acceptable for you, but several passwords in one app is?
(To be clear, I'm not saying your opinion is wrong I just want to understand - usable security is an interest of mine :) )
What functionality has gone from 7 and isn't coming back? Multiple vaults with distinct master passwords and not requiring their cloud backing?
You can set up multiple vaults, but it seems to store the master password for the additional vaults within the first, after the first time you unlock the additional vaults. So, effectively, it's a single vault -- access to the one gets you access to all.
The "mobile-passwords" git repo doesn't have any password I don't use on my phone.
The high value things (bank, email, web hosting accounts) all have 2FA enabled.
The lower value ones, I can easily recover from a breach by simply resetting the PW via my email.
The only real threat I see is if you're storing passwords to things like encrypted containers (Veracrypt, TrueCrypt etc) but as you pointed out if they'd had something running on your system you're hosed either way.