Keepassxc: Some ideas how to make "Paper Backup" more secure

[kraoli]

After reading the https://keepassxc.org/blog/2020-10-03-paper-backup/ post, I had some ideas. Paper backup was always something I avoid, because of the danger that somebody who finds it has access to all my accounts. But at the same time I would like to have a backup.

What is the main threat for paper backups at home?

1. I would say, that someone breaks into your home, find the paper backup by accident and use it.
2. Or that someone who has access to your house does have a look at them unwanted.

This means, it not so likely that they will start an advanced cryptologic attack. The probably just try if the password works or not.

Idea 1:
Add some kind of fixed salt to all password that is not printed in the export to a paper backup. After setting this paper backup phrase, this fixed phrase will be added to every generated or manualy set password at the start position automatically in addition. This phrase could be kept at a different place than the paper backup later.

Example:
You chose a fixed paper backup phase "ILikeKeypass". Now you generate or manually type in a new password in Keypass XC and it will be automatically expanded to ILikeKeypass + PASSWORD.

When you export your passwords to print them, this pre-phrase "ILikeKeypass" is not exported, just the PASSWORD is. So without knowing this fixed salt it's not useful for the average jane and joe.

But you could easily store this phrase at a different place. This way you need both parts to get the passwords.

Idea 2:
Add the possibility to encrypt the exported password with a very simple algorithm, that would be easy to write down and store at a different place.

The simple algorithm could be something like "shift all numbers by X and all characters by Y in the alphabet".

Example:
In this example you chose this "shift all numbers by +6 and all characters by -1 in the alphabet"
When your real password is '1d' it would be be exported as '7c' in the paper backup.

With this simple (cryptologic insecure) algorithm, it would be easy for you to restore your password, but for the average jane and joe highly unlikely that they can get access to your accounts with the paper backup.

Both ideas are of course not 100% secure, but it would buy you a lot of time after a break in to change your passwords, and in most cases even these simple things will prevent that they would manage to get into your accounts at all.

[droidmonkey]

Thanks for the writeup but this seems wholly unnecessary. We won't be adding any _obfuscation_ of an unencrypted output. If you are concerned about theft or casual lookieloos, then I recommend investing in one of these:

[kraoli]

Thanks for responding.

That's unfortunate. While I agree that obfuscation has no place in computer security, I find it a measure that would enhance the paper backup security a lot for the named cases.

I think storing a paper backup in plain text, unlocked in your flat is too risky. And a well build safe is quite an investment and should be built-in the building usually It's not a possible solution for everyone.

But I guess paper backups are usually not a good idea to do anyhow and you should stick to multiple digital backups on multiple storage devices. This is probably the better solution anyhow that would make the paper backup obfuscation superfluous.

[droidmonkey]

Correct, no one is forcing you to do a paper backup, its a choice. Putting a copy of your database, with a simple password, and keepassxc portable on a thumb drive is pretty damn secure if hidden or stored in a safe.

[kraoli]

You're right.

While I still like the idea above to make paper backup more secure against the normal jane and joe, I was focused too much on paper backup as a solution. It's just a good feel to have something alternative when there is a silent data corruption or something without noticing it. And especially flash drive has a higher risk to have bit flips when stored over a long time compared to hdds.

But I guess as soon as you can open the database in KeypassXC that means there is no data corruption on that database. Therefore, just buying some more thumb drives and update them regularly seems the way to go.