Simplify usage of KeePass or equivalent password managers while preserving security

Question

Situation

I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. Since I'm working in a regular workplace with other people I have a quite short interval before KeePass locks itself after inactivity. It would also theoretically be simple for a colleague to covertly film me typing in the password. I'm not particularly afraid of attacks here and now, but I would like to have a stable long-term secure process established.

I also have Keepass-droid on my cellphone which is much easier to use since I can connect it with my fingerprint. If my fingerprints are temporarily messed up I can still open it by using the master password. This it the kind of convenience I'm looking for on a regular computer.

I'm searching for a solution that I can use together with a password manager on a regular computer that:

1. Simplifies the log-on process
2. Still allows the master password as a backup
3. Is not solely dependent on a physical artefact that easily could be stolen and accessed.
4. Reduces the vulnerability to key loggers as long as I don't need to enter my master password.

Thinking about a solution

I've looked at buying an external fingerprint reader that I could connect to my computer and integrate with KeePass* but it seems to be a mixed bag of contrived solutions and paid subscriptions.

I'm also thinking that a possible solution could be if the password manager would allow me to open the same database with either my stronger master password or at the same time with a key file together with a simpler password, a key file that I then could store on for example a IronKey* that is hardware encrypted and locks down after 10 invalid password attempts. Then my workflow would be:

1. Mount the IronKey* in the computer in the start of the work day and open it with the IronKey* password.
2. When I need to open my password database, I use a key file on the IronKey* together with a simpler password (so that the key file is in itself not enough if the key file somehow get wings).

That way I don't have to be afraid of losing my USB-stick as 1) It's difficult to get the key file out of it and it would still require the additional simpler password to open the password database and 2) I could still use my master password to access the database and to set it up with a new IronKey* with a different key file so that I'm not locked out if loosing the stick.

But unfortunately I can't find anything about password managers supporting password or different password + keyfile at the same time. I understand that something like that could be cryptographically non-trivial, but how about if other password + keyfile would just internally return my master password witch in turn would be used to open the real database?

Alternatives that I do not like

I know that it's possible to use a Ubikey together with KeePass in either static mode, one-time password mode or Challenge-Response mode but each of those options does not attract me since the static mode makes me very vulnerable to unauthorized access to the ubikey and the others two will leave me locked out from the password database it I lose the ubikey.

Is there some solution that would enable what I'm searching for and trying to describe above?

^{* Or equivalent}

Answer 1

Disclosure: I work for 1Password, a competitor of KeePass. What I can tell you is that getting stuff like this to work is harder than you might think.

I will say that 1Password allows for a quick unlock (after an initial, rarer, unlock with the master password) with TouchID on Mac and Windows Hello on Windows. If KeePass doesn’t already do that, I would expect that it will soon. Linux is much trickier for a number of reasons, and honestly it has fallen behind what security mechanisms are available in the OS. So obviously I can’t speak for KeePass’s plans there.

Some of the things that you suggested (keyfile + quick code, etc) are things that we (1Password) have looked at or even experimented with. And I can say that while we rejected them, otters might choose otherwise. Instead of talking about the specific challenges to particular mechanisms, I will mention a couple of general things that need to be kept in mind.

What password manager designers need to consider

1. Complexity confuses users, and confused users behave less securely. This might not be as big an issue for KeePass, which tends to have highly sophisticated geeky users. But don’t under-estimate this impact. You can’t expect most users to know what a key file is or the security properties of using them.
2. Complexity leads to vulnerabilities. The actual inner workings of a good password manger are far more complex that it might initially appear. But complexity leads to more bugs, and it makes the security harder to properly analyze.
3. Forgetting master password. When we introduced various schemes to to something like this, we found that if we didn’t force people to use their full master password frequently enough that people would forget their master passwords.
4. No security theater. It is actually hard to design these things in a way that the short cut is fully as secure as it seems. A shorter password or PIN might seem secure enough, but an attacker who gets what is on your disk is going to crack the short ones easily. Remember that for decryption, the attacker is not rate limited by things you put in your software, as they will attack the data directly.
5. Be extremely wary of anything that gives people another way to get locked out of their own data.

Anyway, those are some of the things that the designers of password managers need to consider, but that is different than the question of what you can do for yourself.

Variations on IronKey

If Keepass is scriptable in unlocking (1Password is deliberately not, but Keepass may have made different decisions) then you can roll your own encrypted keyfile solution. Encrypt the master password with short password and have a script that prompts you for the short password and then unlocks Keepass with it. You still would want to keep that file on a removable device. So this is just a variant of your IronKey proposal.

In doing something like this, pay attention to the confidentiality and the authentication of the channel over which the decrypted master password is passed to Keepass. Consider whether it address the threats you face in your environment.