I've been messing around in VeraCrypt and KeePassXC for a while now. And I'm trying to improve my privacy and security. I've been experimenting with different authentication methods. VeraCrypt and KeePassXC implement something called key files. I tried searching for information about doing key files in a website.

I wanted to do this for a website. It takes both a password and a key file.

It kind of went like this:

password_hash(password . salt . key_file_hash)

It worked. But it got me thinking. Websites that I have come across do not implement key file(s). I assume it's because most websites are targeting average users, and they want convenience.

So I have several questions about this:

  • Is it bad to do this even over HTTPS?
  • Should I not do this for a website, even targeting non-average users?
  • Should the key file hash be validated separately from the password hash?
  • If It's okay to store the password and the key file information in the password hash, should I hash the key file contents, or the hash of the key file contents?
  • What other reasons do you think that there might be for this to not be a thing?

To me, it seems like this would bring benefit, as long as they kept their key file safe, etc. This is an additional authentication method, NOT A REPLACEMENT for TOTP or U2F, AN ADDITION.

And keep note that I ONLY count this as beneficial if the user protects their key file carefully and isolates it properly from their other authentication methods.

Make sure you read this carefully. I don't want any confusion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.