Does a password manager's master password significantly improve security?

Question

I use the KeePass password manager, which allows me to change the key derivation/encryption settings. I'm tempted to take time to choose very strong settings and an enormous passphrase.

But does it really improve security ? My understanding is that when a malware runs on a user account (which is the only way it could try to attack my password database), there's not safe way to hide data : it could register keystrokes, or take screenshots when passwords appear on the screen, or try to read the password manager's memory when the database is decrypted, or monitor the clipboard.

Moreover, I don't see the point in investing so much effort in securing my password database when other personal and sensitive data sits unencrypted in my user folder, like connection cookies or my photos archive, which is arguably more sensitive than my passwords : the latter can be changed after a breach, but if the former gets stolen, I've lost. Also, it would bother me more if someone stole my photos than the passwords to my social media accounts.

Finally, I use full disk encryption, preventing someone with access to my computer from using any data on it, including my passwords.

Because of those reasons, I'm considering using KeePass with only a keyfile that would sit in my user folder, making the encryption totally useless as the key would be as accessible as the encrypted file. I know it's not considered good practice, but for the above reasons I don't see the point in securing only this particular part of my data.

Is there any reason I've overlooked that would make this decision stupid ? More generally, how can a master password be a significant improvement in security as a malware would have other easy options to see the passwords ?

Answer 1

All depends on what threats you consider. You are right, if your system is deadly compromised with keyloggers everywhere, there is little that can be done. But what if the attacker can just take a copy of a file and if that file is the password vault?

The common usage of a password manager like Keypass, is the assumption that there is a hierarchy in data sensitivity:

• not so sensitive data can live in unencrypted files on the disk
• highly sensitive data (passwords to bank accounts, PIN code of your credit card, etc.) should be protected with a master password in case of data theft.

If your data does not respect that hierarchy, it is possible that the security of the password vault is not worth a complex master password. But that means that you use Keypass only for its ability to store passwords and no longer for its ability to protect passwords. In that case, you could as well store passwords directly in your browser...

Answer 2

The greatest deal in this matter is to stick with the pen and paper, use relevant information that you need to memorize and use the initials to remember the concept. Change the password every month and remember everyone's special day in one go. Never save those passwords, plus every time I tipe it it helps me memorize the concept. Example: Jd,hd4y.jd,aswY.Jd,fmay.jd,aIk2. Description: Jesus died, he died for you. jesus died, and so will You. Jesus died, for me and you. jesus died, and I know 2.

Answer 3

I would go with a hardware solution to store your access keys like Yubico or others on the market.

You could also use OATH HOTP with keepass and yubico to protect your Keepass database. https://www.yubico.com/why-yubico/for-individuals/password-managers/keepass/

Answer 4

They say that access to your computer is the achilles heel of all security. If someone has a keylogger or password sniffer on your device, malware or physical or whatever, there's really not much you can do to keep it safe. At the end of the day you have to send the password to the login SOMEHOW. Even if you have the password written on a piece of paper in code and change it daily, you still have to enter it to login, and sophisticated malware could still grab it. In truth, I think it would actually be a lot easier for malware to steal a password you physically type out than one accessed blindly in KeePass and then removed from memory afterward. Theoretically, a password file with strong encryption should be safe in the cloud or anywhere else, but if they can steal your master password anyway then it won't make any difference. Even a physical USB key like the ones big tech companies use isn't foolproof, as in some ways it's even easier to steal. So basically it comes down to keeping your computer free of malware, avoiding phishing techniques and observing good-practice methods like not keeping your logins in a Word file on your desktop with nothing to stop your local burglar from finding them.

Personally, my mind rebels at the idea of leaving the key to the file sitting right next to the password file, but if your computer is encrypted anyways, than any real threat short of the drug-him-and-hit-him-with-a-wrench technique is going to come from online. Full-disk encryption should protect data dumps or any memory-extension-via-hard-drive systems on your machine. I still would recommend keeping passwords encrypted beyond hard drive encryption, though. You never know who might stumble across your computer in the 30 seconds you step away to refill your coffee.

So again it comes down to how paranoid you're feeling. If your government really wants your collection of cat photos, they have much more direct ways of getting access than by playing cloak-and-dagger with your password manager. For most things, good-enough security is probably good enough. After all, there are plenty of easier targets out there.