Re:Password Managers: Under the Hood of Secrets Management
by dontbenebby on Wednesday February 20, 2019 @12:49PM
(#19210026)
Do you think having a separate database (with the key stored in a safe place) might be a happy medium between "keep them in a safe" and "keep them in the same locked container as the passowords"?
Or do you think that having both DBs on the same (possibly compromised) machine is too much risk?
Re:Password Managers: Under the Hood of Secrets Management
by icebraining on Wednesday February 20, 2019 @01:33PM
(#19210589)
Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.
Re:Password Managers: Under the Hood of Secrets Management
by dontbenebby on Wednesday February 20, 2019 @03:35PM
(#19211711)
> Seems like a good approach, if you use asymmetric encryption. Keep the private key in a safe place, and the public on the machine; then you can store new codes (by encrypting them with the public key) without having to access the safe place.
Interesting idea. I had just been picturing a second keepass db with a different passphrase (or use a usb key with a keyfile kept offsite) but I like yours too.
(I'm also trying to brainstorm solutions scalable to non-experts so "&Ok fire up the CLI, we're doing GPG*" might work for me, but not everyone in my org :) )
My recovery codes are on index cards in a physical safe, and then I've got MFA via multiple devices (TOTP on Phone + yubikey for most things).