I'm trying to improve my password management, and I have a vision in mind for a solution. However, I'm having a problem putting it all together or finding a product(s) that fits.
First I would like to find out if my overall specification/strategy is workable?
Baseline (non-negotiable) requirements:
- A password manager with an encrypted (AES-256 or better) local-only password database/vault. No cloud storage: so services like LastPass etc. are not going to work for me. (Password manager in the sense that all account passwords are accessible from a single master password)
- Installable / integrated onto a hardware-encrypted USB-3 thumb drive, preferably one of those with a numerical keypad on the side of the thumb drive that unlocks the drive before inserting into a USB port. The password manager software runs directly from the thumb drive (Windows minimum, but Windows + Android preferred) without any software installation required onto the host system.
- Ability to backup the password database/vault (in case the encrypted thumb drive gets lost or stolen).
Feature requirements (really, really want these, too):
- Can generate randomized passwords for new accounts
- Can autofill login ID and password fields in a browser window without the need for copy/paste (and therefore avoids the security holes involved with Windows clipboard).
Next-level features (all above could likely be accomplished with KeePass + hardware/keypad encrypted thumb, but the below would bring the overall security to the next level - if this is achievable and a product(s) exists...?)
- Multifactor authentication (like U2F) of the password manager software/vault itself: the encrypted USB drive itself serves as the hardware token that allows the software/vault to unlock (something along the lines of a Yubikey). That way if the password vault file itself is copied from the thumb drive (from across the network, say at work), and they grabbed my master vault password (for example a keylogger), the vault still could not be unlocked / unencrypted because they wouldn't have the physical hardware token serving as the 2nd authentication/decryption factor.
- And to really ensure a robust solution, the USB drive would adhere to the military spec for encrypted drives (FIPS 140-2 Level 3 compliance, incl. testing by an independent lab)
My last arrangement was close: the Ironkey (before the company was purchased by Kingston). It was a FIPS compliant encrypted (USB2) drive with onboard proprietary password manager software. But the password manager has been dropped from the product line, leaving it (basically) just an expensive hardware encrypted thumb drive.