4

I use KeePass to store my passwords, but it still concerns me a little bit that now all my passwords are guarded behind a single password. It would be nice if it could do 2-of-3 authentication (not sure if there's a name for this). e.g. you must provide 2 of the following 3 options: a password, face recognition, TOTP.

This way if I forget my pass or lose my phone or my face gets burnt in a fire, I can still access my password database, but it's also more secure than a password alone.

Is there any software that does this?

OS: Windows 10, Linux (Ubuntu), and Android. (it's OK if certain versions only support 2 of the 3 methods -- it just means they'll be non-optional)

Budget: I guess I'd pay up to 10 or $20 if this worked well. Depends how good the software is. Free + open source is of course always preferred :-)


Must have features:

  • Must store usernames, passwords, URLs and Notes
  • Must be easily searchable
  • Organize entries into folders
  • X-of-Y authentication (discussed above)

Nice to haves:

  • Ability to assign each entry an icon
  • Auto-type (select entry and press button to re-focus last window and autotype username + password in secure fashion)
  • Global auto-type (hotkey that will work when any app has focus)
  • Nestable folders
  • Ability to import KeePass KDBX file

Aside: How would facial-recogition-as-a-key even work? Passwords work because they have an exact byte sequence that can be used to encrypt another piece of information, but a mugshot does not have that property.

  • Perhaps Intel Truekey? – SEJPM Jan 8 '16 at 22:59
  • So the solution must not necessarily work with KeePass, but could be a different password manager, right? If that’s the case, please list the basic features the password manager would need to have. – unor Jan 9 '16 at 20:54
  • You could setup key-based authentication in addition to a password, effectively putting a two-factor authentication scheme. Not quite the same as face recognition but adds more security than just a password. – Alejandro Jan 10 '16 at 0:29
  • @Alejandro I noticed that. The idea is you'd put the keyfile on a USB stick right? Then unless you have the stick, you can't get in? But what if your USB key breaks? Or if I don't have it with me? There's too many concerns with that I think. – mpen Jan 10 '16 at 0:32
  • @unor I've updated the question as per your request. It doesn't have to be a KeePass [2] plugin, but it sure would be nice (save me the trouble of porting ~300 passwords) – mpen Jan 10 '16 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.