Qfyilyi

Where do you store the KeePass-DB?

Where would you recommend me to store a Keepass-file? Usually I have my personal documents in my cloud account - but i am not sure if this is safe.
Would it be safe to use the cloud for this file? Can i secure it even further, by adding another (extra) layer of security by encrypting the file.
General question; How safe is this? What risks do I need to know about?

What can I do with the KeePass password file, there are several arguments to decide where to store it.
In my humble opinion, if the passwords are really, really important to someone, one should make the decision based on:

• the risk of the file being hacked - what can we do if we consider to get hacked


• the risk of losing the file because of having a bad hdd - what do you do if you face disk errors. And sure thing -. there are more things to think


• what if someone may compromise the file


• is it preferable that the DB file not get in the wild,


• there may be more and other risks - which one do you take into consideration"?


• what if my cloud storage account is getting compromised then having the credentials recovered by either brute force or some other attack vector.

What if someone may compromise the file?

• Options; can I secure it even further, by adding another layer of security by encrypting the file i am going to store in cloud storage
  online.


• regarding the master password: master password provides pretty good security as long as i choose a difficult to brute force password (long
  and truly random),


• on the other handside - a masterpassword still can't compete with an actual long encryption key.


• we can increase the resiliency of the KeePass database to brute force by increasing the number of PBKDF2 iterations


• we can do this in KeePass under File > Database settings > Security: Personally, I use around 10,000,000 rounds (2 s delay).

well -- as mentioned above; I use the KeePass-cloud combination. The password database is encrypted using a key derived from a strong master password.
Even if somebody acquires the encrypted password database through the cloud account, a strong enough master password renders brute-force attacks infeasible.

What can I do with the KeePass password file? Which of the arguments do you take into consideration, to decide where to store it?

In theory, you can store the database file anywhere, it's encrypted with it's own passphrase (or keyfile).

If you're worried about someone trying to guess your passphrase or otherwise break into it, you're free to encrypt it a second time with any other reputable encryption method. GPG/PGP is good, or a TrueCrypt successor, or a dm-crypt/LUKS container (though LUKS are generally >2MB, a KeePass database could be under 100k), there's a lot to choose from.

Encrypting the file a further 3rd, 4th... nth time should multiply your protection (provided the encryption itself isn't broken), but it also multiplies the number of passphrases/keyfiles you have to remember, and the time to decrypt them all.

In case someone modifies a KeePass database file, even one byte difference, KeePass should notice and warn you. I tried modifying a single byte in the middle and it complained:

The following error occured while opening the database:

Hash test failed.

The key is wrong or the file is damaged.

Modifying the very first byte complained:

The following error occured while opening the database:

Wrong Signature

Modifying a byte in a gpg file gives a similar complaint (but still decrypts the file, with about 8 bits changed - KeePass would then complain again refusing to open it):

gpg: WARNING: encrypted message has been manipulated!

You can always keep your own checksum/hash of the file too (sha sums are popular, md5sum still, even a CRC32 should detect corruption), just to verify that it hasn't changed.

Few things:

1) Keep the master passPHRASE not passWORD on soemwhere NOT in the cloud.

2) Consider using some form of pki if you plan to have copies in the cloud of some other format/location ( like a safety deposit box ) so that compromise is easier to spot as well. If someone were to play funny with it the key (PGP/PKCS or similiar) would be all sorts of screwed up playing the needed aspect of canary.

3) look into rate-limiting inside and outside of KeePass application

4) if possible for networked devices, or separate hard drives set locks on users and credentials that would be allowed to access this.

5) The RINGER: in the event of a compromise of YOU, illness,captive or whatever, does a trusted party have a way to access without giving them your personal key(s) or full access unless neeeded (a lawyer,doctor for example)