19
2FA with Keepass
(lemmy.world)
To integrate 2FA with keepass perform the following steps
-
Enable 2FA in settings, save it . If 2FA installation link button is not visible, refresh page to see it.
-
Copy the link and extract the secret key from it. Example: otpauth://totp/Lemmy.world:echo0618secret=XXXXXXXXXXXXXXXXXXXXXXX&algorithm=SHA256&issuer=Lemmy.world Here secret key = XXXXXXXXXXXXXXXXXXXXXXX
-
Go to keepass and setup your TOTP with the secret key and use custom setting to generate the key, with Algorithm = SHA-256, keeping the other settings unchanged
https://lemmy.world/pictrs/image/ace6eb80-daf0-4dcb-9a45-919ae9e74e4e.png
- Save the TOTP changes. Go incognito mode and login.
While it's possible, I believe it's still best to seperate your passwords and 2FA.
Saving both in one place kinda defeats the purpose of 2FA.
True. PSA: if you want the convenience of something like Authy, but with an open source e2e approach: there’s Ente Auth. I’m using it since about a month.
https://github.com/ente-io/auth
EDIT: I also successfully used this (very hacky) approach to extract all my TOTP secrets from Authy (which they normally don’t allow), brought them into the correct format with a small powershell script and imported them successfully into Ente Auth. But beware: it’s really really hacky.
yep this is the way
Agreed, don't do this. If your system is compromised, then the moment you unlock your Keepass database, even just once, the attacker now has both your passwords and your TOTP keys and can impersonate you anywhere.
Where I work we are phasing out TOTP in favour of FIDO2 keys, and the ability for users to store TOTP keys in a password database alongside their passwords is one of the key reasons.