Menu

Wipe History

fileyo5853
2020-07-03
2020-07-03
  • fileyo5853

    fileyo5853 - 2020-07-03

    Is there any way to completely wipe the history (incl. creation/modification time) of all stored passwords? This could enhance security as well.

     
  • Paul

    Paul - 2020-07-03

    There is no way to do that without a lot of effort. It would not enhance security - once the database is unlocked there is not a lot to stop bad actors accessing your passwords.

    cheers, Paul

     
  • fileyo5853

    fileyo5853 - 2020-07-03

    Though when you use for one password some chars of another stored password in combination this would still help, since the attacker can't r.e. something from last modification date.

     

    Last edit: fileyo5853 2020-07-03
    • Horst

      Horst - 2020-07-03

      Think once again !
      If the attacker can access the history he has full acces to your datbase
      and can read the actual passwords.
      So what is the benefit of deleting the history ?
      You would loose the history for old backups of your database
      and the attacker loose nothing.

       
  • Paul

    Paul - 2020-07-03

    If they can access the time info they can access the password itself.

    cheers, Paul

     
  • steelej

    steelej - 2020-07-03

    Though when you use for one password some chars of another stored password in combination this would still help, since the attacker can't r.e. something from last modification date.

    Why would anyone want to do that? This would weaken your security and I cannot envisage any case where this would be good practice.

    Keypass has a random number generator to avoid having any linkage between passwords.

     
    • fileyo5853

      fileyo5853 - 2020-07-03

      What I mean is, you know (in your mind) you append char 4-6 from password x to password y at position 3, which results in the real password.

       

      Last edit: fileyo5853 2020-07-03
  • Paul

    Paul - 2020-07-03

    KeePass enters the password for you, no need to remember anything, display the password or type it yourself.

    cheers, Paul

     
  • steelej

    steelej - 2020-07-03

    What I mean is, you know (in your mind) you append char 4-6 from password x to password y at position 3, which results in the real password.

    Why on earth are you doing this? It sounds terribly complicated. Perhaps you think it adds something to your security?

    If you make your random password long enough (and it does not have to be all that long 15-20 characters from memory is usually more than enough) your login would be much simpler and probably more secure.

    Just use Keypass to automatically type your randomly generated passwords and avoid the unecessary manual comexity. How often do you get this wrong?

     
  • John Jones

    John Jones - 2020-07-03

    As said here, dates are encrypted inside your DB, if an attacker can access them it could also access the password themselves.

    Adding additional characters to your password can improve password is some scenarios but I have two things to say for that:

    Firstly, there are much better options like 2FA based on TOTP or push to login which offer much better security than some random letters when it comes to authentication.

    Secondly, KeePass saves your actual password history by default. so you can see previous passwords as well.

     

Log in to post a comment.

MongoDB Logo MongoDB