1

I have a python bot that runs in Windows 10 and accesses Keepass with a password. I'm wondering what would be the correct way to store and access this Keepass password.

Currently, the Keepass password is encrypted and decrypted with a key. However the key is available to the python bot and therefore to anyone.

Am I missing something?

Improve this question
3
  • Define "everyone"? What are the threats here?
    – schroeder ♦
    Commented Nov 7, 2020 at 18:50
  • @schroeder Thanks. Specifically, it sounds instinctively unwise to store the Keepass password in plain text but it's not completely clear to me what protection is gained by encrypting it and then decrypting it with key during the script. Also, I am not sure what additional steps could improve security.
    – AturSams
    Commented Nov 7, 2020 at 19:20
  • 1
    Q: what function, utility or library does your bot use access the keepass database? why does it use keepass, and not some other mechanism to secure the credentials?
    – brynk
    Commented Nov 9, 2020 at 2:07

1 Answer 1

Reset to default
1

On Windows, you have the option of using the Data Protection API (DPAPI) either:

  1. Natively in KeePass (getting rid of the password altogether)
  2. In your script (retreiving the password)

1. Natively

Make your KeePass database use "Windows User Account" encryption. It uses DPAPI behind the scenes to encrypt your master database key. It's all automagic as long as the account exists. It is hard to recover if the account is destroyed.

KeepPass "Windows User Account" option

2. In your script

You can write Python code to save and later retreive the password using DPAPI. YMMV but this StackOverflow question offers a few alternatives.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .