No, for exactly this reason.

My recovery codes are on index cards in a physical safe, and then I've got MFA via multiple devices (TOTP on Phone + yubikey for most things).

Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same locked container as the passowords"?

Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?

Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.

> Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.

Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too.

(I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )

This is why I refuse to upgrade from 1Password 4. Or switch to another product.

I haven't found anything that I can self-host and allows me to have multiple "vaults". And I refuse to keep all my 2FA codes and recovery codes in the same place as the passwords, since that completely defeats the point.

When I asked 1Password about it, their response was that the functionality wouldn't be coming back in 7 because it wasn't a supported configuration -- it's called 1Password so users should only ever be remembering one password!

If Keepass's entire UX wasn't hot garbage it would be perfect. But here we are.

Have you tried KeepassXC?

It can do this, and I don't see anything remotely resembling "hot garbage" in its UX.

https://keepassxc.org

I use this as well as 1Password. I'd describe the UX generally as being 'hot garbage' compared to 1Password. The difference in polish is night and day.

That said, based on this report, the security model is significantly better, so the decision becomes do I care more about usability/being pretty, or security.

The never-ending trade-of between security and usability continues...

>I haven't found anything that I can self-host and allows me to have multiple "vaults".

I'm not familiar with 1Password. How do you access these various "vaults" - you type a password, correct?

I guess I'm not following why multiple Keypass DBs with multiple passphrases is not acceptable for you, but several passwords in one app is?

(To be clear, I'm not saying your opinion is wrong I just want to understand - usable security is an interest of mine :) )

> When I asked 1Password about it, their response was that the functionality wouldn't be coming back in 7 because it wasn't a supported configuration -- it's called 1Password so users should only ever be remembering one password!

What functionality has gone from 7 and isn't coming back? Multiple vaults with distinct master passwords and not requiring their cloud backing?

Yes, exactly that.

You can set up multiple vaults, but it seems to store the master password for the additional vaults within the first, after the first time you unlock the additional vaults. So, effectively, it's a single vault -- access to the one gets you access to all.

you might want to check out Enpass. Multiple vaults and mobile clients are a premium feature, but the desktop app is free and fully local with self-hosted sync options. I'm not affiliated, but have been a happy user for a couple of years.

I use pass with multiple vaults. Not the same 2 vaults as you want, but I run one "everything" vault, and another one for just "mobile".

The "mobile-passwords" git repo doesn't have any password I don't use on my phone.