I've been messing around in VeraCrypt and KeePassXC for a while now. And I'm trying to improve my privacy and security. I've been experimenting with different authentication methods. VeraCrypt and KeePassXC implement something called key files. I tried searching for information about doing key files in a website.
I wanted to do this for a website. It takes both a password and a key file.
It kind of went like this:
password_hash(password . salt . key_file_hash)
It worked. But it got me thinking. Websites that I have come across do not implement key file(s). I assume it's because most websites are targeting average users, and they want convenience.
So I have several questions about this:
- Is it bad to do this even over HTTPS?
- Should I not do this for a website, even targeting non-average users?
- Should the key file hash be validated separately from the password hash?
- If It's okay to store the password and the key file information in the password hash, should I hash the key file contents, or the hash of the key file contents?
- What other reasons do you think that there might be for this to not be a thing?
To me, it seems like this would bring benefit, as long as they kept their key file safe, etc. This is an additional authentication method, NOT A REPLACEMENT for TOTP or U2F, AN ADDITION.
And keep note that I ONLY count this as beneficial if the user protects their key file carefully and isolates it properly from their other authentication methods.
Make sure you read this carefully. I don't want any confusion.