I'm using KeePass to manage my password together with a long complicated password. I need to access passwords quite often so it's a little cumbersome to have to enter the password each time. Since I'm working in a regular workplace with other people I have a quite short interval before KeePass locks itself after inactivity. It would also theoretically be simple for a colleague to covertly film me typing in the password. I'm not particularly afraid of attacks here and now, but I would like to have a stable long-term secure process established.
I also have Keepass-droid on my cellphone which is much easier to use since I can connect it with my fingerprint. If my fingerprints are temporarily messed up I can still open it by using the master password. This it the kind of convenience I'm looking for on a regular computer.
I'm searching for a solution that I can use together with a password manager on a regular computer that:
- Simplifies the log-on process
- Still allows the master password as a backup
- Is not solely dependent on a physical artefact that easily could be stolen and accessed.
- Reduces the vulnerability to key loggers as long as I don't need to enter my master password.
Thinking about a solution
I've looked at buying an external fingerprint reader that I could connect to my computer and integrate with KeePass* but it seems to be a mixed bag of contrived solutions and paid subscriptions.
I'm also thinking that a possible solution could be if the password manager would allow me to open the same database with either my stronger master password or at the same time with a key file together with a simpler password, a key file that I then could store on for example a IronKey* that is hardware encrypted and locks down after 10 invalid password attempts. Then my workflow would be:
- Mount the IronKey* in the computer in the start of the work day and open it with the IronKey* password.
- When I need to open my password database, I use a key file on the IronKey* together with a simpler password (so that the key file is in itself not enough if the key file somehow get wings).
That way I don't have to be afraid of losing my USB-stick as 1) It's difficult to get the key file out of it and it would still require the additional simpler password to open the password database and 2) I could still use my master password to access the database and to set it up with a new IronKey* with a different key file so that I'm not locked out if loosing the stick.
But unfortunately I can't find anything about password managers supporting password or different password + keyfile at the same time. I understand that something like that could be cryptographically non-trivial, but how about if other password + keyfile would just internally return my master password witch in turn would be used to open the real database?
Alternatives that I do not like
I know that it's possible to use a Ubikey together with KeePass in either static mode, one-time password mode or Challenge-Response mode but each of those options does not attract me since the static mode makes me very vulnerable to unauthorized access to the ubikey and the others two will leave me locked out from the password database it I lose the ubikey.
Is there some solution that would enable what I'm searching for and trying to describe above?
* Or equivalent