I do believe using just your windows user account to encode your database password is inferior to encrypting it with the pin (Windows Hello Security Key. Prompting the user's pin should be possible in c# (Github Windows Passport example). Don't know how to contact Theo about this. Do you think it's worth a try?
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Why is it inferior? If you login to Windows via Hello then you are using the same level of security.
Are you proposing using Windows Hello as the master key to open a KeePass database? That prevents you sharing the database with non-Windows / your Windows machine and makes recovery more difficult.
cheers, Paul
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
If you login to Windows via Hello then you are using the same level of security.!
This is true only if you always log out of Windows when leaving your PC unattendet. If you leave your computer (e.g. while time consuming calculations run in background), anyone can open keepass with two keystrokes on the enter key. This is the situation where I believe additional security is added.
Are you proposing using Windows Hello as the master key to open a KeePass database?
No I am not. As you stated correctly this would undermine sharing the database.
I hope I could clarify my request. Thanks for the fast reply. Let's discuss this further.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I don't know what strange config you are using
but no one can open my KeePass while I'm away or doing long calculations
because its configured to lock after a short time of usage.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
The purpose of the winkee plugin is to unlock a database without password, just by using the windows account. This configuration is standard when using this plugin I suppose.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I do believe using just your windows user account to encode your database password is inferior to encrypting it with the pin (Windows Hello Security Key. Prompting the user's pin should be possible in c# (Github Windows Passport example). Don't know how to contact Theo about this. Do you think it's worth a try?
Why is it inferior? If you login to Windows via Hello then you are using the same level of security.
Are you proposing using Windows Hello as the master key to open a KeePass database? That prevents you sharing the database with non-Windows / your Windows machine and makes recovery more difficult.
cheers, Paul
This is true only if you always log out of Windows when leaving your PC unattendet. If you leave your computer (e.g. while time consuming calculations run in background), anyone can open keepass with two keystrokes on the enter key. This is the situation where I believe additional security is added.
No I am not. As you stated correctly this would undermine sharing the database.
I hope I could clarify my request. Thanks for the fast reply. Let's discuss this further.
I don't know what strange config you are using
but no one can open my KeePass while I'm away or doing long calculations
because its configured to lock after a short time of usage.
The purpose of the winkee plugin is to unlock a database without password, just by using the windows account. This configuration is standard when using this plugin I suppose.
There is already a Windows Hello plug-in.
cheers, Paul
Oops. Sry. Thic can be closed. Thank you very much Paul.