1

I want to make sure nobody can quickly copy away my keepass database file should I ever let the person work on my PC unattended (which sometimes is inevitable unfortunately) so I was thinking about just adding lots of GB of random trash file attachments into it so it would take a lot of time at least to copy it over to somewhere else

Are there better options?

Improve this question
1
  • Put the database file on a USB stick or SD card which you remove whenever you leave the PC. Note that if you don't trust the people working on your PC, there's a far bigger problem: They could install malware and do pretty much anything they want, which includes getting your master password and simply decrypting the database. So maybe you should at least take some basic countermeasures against this more fundamental issue -- like giving the person a separate user account which cannot access your files (this doesn't stop a determined attacker, of course).
    – Ja1024
    Commented Sep 2 at 6:16

3 Answers 3

Reset to default
0

Use a strong pass phrase. Use enough rounds for the key derivation function to slow down attackers. Everything else is just obscurity.

Improve this answer
0

As well as just keeping your KeePass on a USB stick rather than on your computer (obviously secured with a strong passphrase*), KeePass also supports the use of keyfiles. So you could keep the DB locally, and then keep a separate key file on a USB stick and makes sure that you never leave that in the machine.

That way if they made a copy of your KeePass database (and even guessed your passphrase) they wouldn't be able to open it without also getting hold of the keyfile.

But as other have said, if you don't trust someone then you shouldn't give them unattended access to your workstation - because there are all kinds of other malicious things they could do.

Improve this answer
0

I don't think it's that easy to protect the file itself, but there are still some options:

  • Use a master password that is as complex as possible. If necessary, think about using a key file, see also: https://keepass.info/help/base/keys.html. The use of Argon2, for example, could be very helpful to additionally protect the database against attacks. Above all, take a look at the underlying algorithms that protect your data and consider which one you want to use.

  • You can check the logs, possibly automatically, which is good for finding out as quickly as possible whether data has been leaked. This way, you can take the appropriate steps as quickly as possible.

  • What you could also do would be to move just this one file to a (virtual) encrypted drive, for example by using VeraCrypt or Bitlocker. I will not go into any vulnerabilities of these applications themselves in this context. Of course, the PW of this drive is also a potential vulnerability, but it increases the complexity of accessing the actual file from an attacker's perspective, without a doubt. Of course, this drive does not have to be virtual in this context, it could also be physical hardware, if you prefer.

If this is all too insecure for you, you might be better off switching to a different form of password management, but with the aspects mentioned above, you're already well on your way. Alternatively, you should consider whether there is a way to prevent the unauthorized person from accessing your account in the first place.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .