[40four]

Started using Keypass about a year ago, I really like it. Just wondering if Dropbox is considered a safe place to store the DB files? I did this for a while, but then I got paranoid and switched to something fully encrypted.

For sharing between devices I found Firefox Send to be useful (before it went down, hope it comes back), also Keybase filesystem is one of my go-tos as well.

Maybe I’m being overly cautious, but I sleep better at night knowing my DBs are encrypted.

[WorldMaker]

The database files are encrypted by your master password (and optional key file, etc) at rest, but paranoia with your sync provider is valid. It's one of the reasons that I like Keypass, because sync provider is something I control and any "file-like" share can be used I don't need Keypass-specific providers.

Fwiw, I've lately been using Resilio Sync, which is BitTorrent style peer-to-peer between devices I control and encrypted over the wire as well. It also supports advanced encrypted shares where you can even have "know nothing" devices that help to seed/participate in your shares but can't read/write inside them, as an interesting tool in "personal cloud hosting".

[vbezhenar]

Your database is encrypted by default. Additional encryption won't hurt, of course, but you can absolutely use Dropbox.

[40four]

Right, I guess my concern was a brute force attack on a DB file if it fell into the wrong hands. I looked at the main website again though, and apparently the official Windows app has some protection against this. It says however, KeypassX (and I assume therefore KeypassXC) does not have the same level of protection.

Another comment mentioned using a key-file, so maybe I will revisit that approach, since I used password only when I started.

[vbezhenar]

To prevent brute force attack, you should choose long enough password and adjust iterations parameter on Key transformation. Basically more iterations = more time to brute force, but your application will spend more time opening the database. Longer password = less likely for brute force to succeed.

For me 12 characters password with default 60 000 iterations seems safe enough. My estimation is that it would take at least millions of dollars to break it and my passwords are not worthy of that. You can easily make it into unbreakable for a foreseeable future by using something like 16-characters random password and 10 millions of iterations.

Key file of enough length is like an unbreakable password. But you probably can't remember it, so be careful not to lose it. My database is accessible on public URL which I remember and I remember my password, so I can always download it anywhere and open it. I think that it's a big advantage and I wouldn't want to lose it.

[40four]

Great, Thanks for the advice!

When I decided to start using a password manager, I was drawn to Keypass since it is open source and I don't have to rely on any third party service. But learning how to use it correctly, and juggle your db files among all your devices requires a sound, thought out strategy!

[cpburns2009]

I store the KDBX file in Dropbox, store the key file elsewhere, and use a strong password. Without the key the database file is useless.

[40four]

I currently only use a password/phrase, but I will consider using a key file as well. My concern was a brute force attack on a compromised DB file. But I guess as long as the key-file was never put in the cloud, this would alleviate that concern?

[JeremyNT]

Yes, when you want to use a new device you sideload the key file onto it in a secure manner (i.e. USB).

On Android this presents some issues though, since the last I checked the keyfile had to be added to the "SD Card" class storage, which other apps can also access. If you are on android and go this route, be really careful about the types of apps you install that have Storage permissions (good advice in general, of course).

[40four]

Good points. I used to use Android, but recently switched to iOS, mostly because I have a Macbook pro and iMac.

I'm not blown away by the iPhone in general honestly, but being able to sync everything between the Mac devices is super convenient. The ability to easily share files wireless-ly between all of them via Airdrop is fantastic. Great use cae for moving KBDX files, or in this case key-files is super useful.

[nix23]

>Keybase

They are sold to ZOOM...since then i dont use it anymore

[qes]

If KeePass's database file wasn't secure on it's own, then it would be quite useless.

[zeeone]

If you’re concerned about security, you wouldn’t use Dropbox in the first place. Use mega.nz instead.

[Nullabillity]

KeePass(XC) encrypts the database on its own.