To integrate 2FA with keepass perform the following steps
-
Enable 2FA in settings, save it . If 2FA installation link button is not visible, refresh page to see it.
-
Copy the link and extract the secret key from it. Example: otpauth://totp/Lemmy.world:echo0618secret=XXXXXXXXXXXXXXXXXXXXXXX&algorithm=SHA256&issuer=Lemmy.world Here secret key = XXXXXXXXXXXXXXXXXXXXXXX
-
Go to keepass and setup your TOTP with the secret key and use custom setting to generate the key, with Algorithm = SHA-256, keeping the other settings unchanged
https://lemmy.world/pictrs/image/ace6eb80-daf0-4dcb-9a45-919ae9e74e4e.png
- Save the TOTP changes. Go incognito mode and login.
Been using KeePass for over a decade now and didn’t realize it could do this. Thanks for the tip.
While it’s possible, I believe it’s still best to seperate your passwords and 2FA.
Saving both in one place kinda defeats the purpose of 2FA.
True. PSA: if you want the convenience of something like Authy, but with an open source e2e approach: there’s Ente Auth. I’m using it since about a month.
Agreed, don’t do this. If your system is compromised, then the moment you unlock your Keepass database, even just once, the attacker now has both your passwords and your TOTP keys and can impersonate you anywhere.
Where I work we are phasing out TOTP in favour of FIDO2 keys, and the ability for users to store TOTP keys in a password database alongside their passwords is one of the key reasons.
Just a note that 2fa wouldn’t have helped with the most recent vulnerability. The attackers were grabbing your already authenticated session and re-using that.
