I want to start using keepass to set and get my passwords. To always get access

Question

I want to start using keepass to set and get my passwords. To always get access to them I thought about using keepass-portable on an USB-stick. So I would have an USB-stick with a the program keepass-portable, my password-database and my keyfile on it. When I am on any computer, I have to put the stick in to get to one of my password. When using my android-phone, I would use the keepass-app and need the keyfile stored on the phone-sd-card. My problem is, that everything you need is on that USB-stick/phone. So if I loose it or my android-phone, the one who finds one of this would have my database AND my keyfile. Shouldn't keyfile and database be seperated? But how do I use such an USB-stick or my then when in front of a foreign computer?

Explanation / Answer

Yes, you should keep your keyfile separate from the database.

But the keyfile does not change often (if at all), so you don't need to keep moving it around with you in a vulnerable manner - just load it ONCE on each device, and that device will remain authenticatable.
You can do this manually - consider it a "device registration" process, and do it any manual way you want, just don't leave copies of the keyfile floating around anywhere EXCEPT the registered devices.
You can keep carrying the database file around with you on a USB stick (or float it in the cloud), and keep it up to date.

I am assuming, of course, that you are talking about a small set of pre-defined devices - your computer, your laptop, your phone - and not just any arbitrary computer you happen across.

If you do need to read your keepass database on arbitrary computers you do not control - then don't. If you really really need to - don't.
Once you unlock the database file on an untrusted computer, all your secrets are leaked out. So don't do that.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.