1

I was investigating the security of keyfiles vs passwords and thinking that possibly the keyfile could bypass keyloggers that might be installed on my machine.

Improve this question
2
  • is this in use with a password manager application? Would you be using a keyfile AND password combination? Because if so - which is preferable - the keylogger is still going to pick up your password it just wont be able to use your keyfile. You'd also want to be storing that keyfile off the compromised machine because if you have a keylogger, you could just as easily have other nasties capable of nabbing your keyfile.
    – R. Murray
    Commented Dec 20, 2016 at 2:37
  • note: if you are on Windows the "secure desktop" may interest you (see options > security tab > "Ente master key on secure desktop" at the bottom list. keepass.info/help/kb/sec_desk.html
    – xaa
    Commented Dec 20, 2016 at 12:35

2 Answers 2

Reset to default
3

Depending on what malware is installed on your system, like you said key loggers will log your master key back to the attacker but if an attacker wanted to gain access to your password database then he will just install a more sophisticated piece of malware to download your key file.

Improve this answer
1
0

Matthew1471 is absolutely right. I think that law will always be true. To prove it, here is an article that details exactly how to crack the keypass storage to obtain passwords. https://cqureacademy.com/blog/windows-internals/safe-store-password-keepass-browser Still, using a solution like Keypass, Lastpass, onepass or any other (that is good) is a much better risk to take than falling back to using the same password across all systems.

Improve this answer
1
  • That article cracks a KeePass database stupidly set up with "Windows Users Account" as the only part of the master key. The KeePass author explicitly recommends against using that option at all, much less as the sole security of the database. Terrible example!
    – Ben
    Commented Feb 9, 2017 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .