Would it be theoretically possible to link different local users to different fingers via Fingerprint scanner (like index finger: normal user, little finger: guest user)? Desktop PCs nowadays can switch between different desktops, maybe on the JP you could have a work-only profile and a private one etc. etc. without cluttering them with all the apps you ever installed (and maybe without connections not needed in that profile, like “no games at work”).
Cheers
I guess one could store the DB password in a Secrets collection…
But it’s a bit weird to store a password to a password store in another password store.
Also decreases security of course. It’s the point of the keepass password that it’s not stored anywhere.
Fingerprint unlock is an absolute no-go IMO.
2 Likes
Pepepep! Would you please develop a bit if you like or have time?
I might be missing something important here.
Do you recommend not using the FP?
Unfortunately, I’m not a developer, but I do know that fingerprints are a surveillance attribute.
So yea… we shouldn’t give it away. Not even to our (hack able) phones.
2 Likes
In a public place, biometric authentication is more secure and practical than a password or PIN.
If someone memorizes what you type, they can then gain access to all your data.
Practical, yes. Secure, no. PIN is to easy, but a good password still is the best protection. Of course you shouldn’t give that away either, by showing it in public.
Just be aware when you type it… or don’t drink that much beer. 
Maybe I should say “pass phrase” instead of password. Passwords have to be complex to be safe.
1 Like
Yes, agreed.
When I arived on SFOS, it was my first device with fingerprint reader.
I was worried about the safety/privacy aspect of it.
But I have been explained here, that the fingerprint stays in the device and cannot be seen or stolen.
Is that not the case anymore, or not true?
Instead, wasn’t @nephros reluctant to it, in case some rubber forces one to apply the finger?
Security aspects of FP readers (which are just very stupid cameras), or the security of their storage aside, anything that adds an additional way to unlock a keystore decreases its security.
That being said, ownKeepass already has that ‘three letter unlock’ feature, tying a successful FP reading to that mayy be okay.
But initial unlock by the real passphrase must stay.
I mean cool feature right, I steal someone elses keepass file, put it on my Jolla and unlock it with my fingerprint, cause the phone sais it’s okay. Great!
What’s next, unlock via Bluetooth MAC?
4 Likes
Passwords and PINs can be easily changed if needed, biometrics are bit harder to change…
4 Likes
Thank you for explaining.
So, actually, there is nothing like a passphrase exchange into some kind of opaque pipe between an app/function and the FP reader.
Is it more like: the app says “hello FP, can you scan to tell me of I can do this?” and the answer is just yes or no.
Hence the danger that the simple FP answer could be imitated or generated on another device, IIUC.
But biometrics are harder to replicate…
Correct. Fingerprints are hard to changes. And fingerprints are easy to get. You only need the glass the beer was in.
Important is also: Law enforcements can force you to give the fingerprint and to open the phone via fingerprint. This is common law in many countries. And not all countries are so correct and nice as yours.
But in all countries you can forget a pin. We are humans, our memory is not perfect. And we all know, forgetting can be a grace.
@eson Be carefully!
5 Likes
steal someone elses keepass file, put it on my Jolla and unlock it with my fingerprint, cause the phone sais it’s okay.
That’s not my understanding of how KeePassDX does it or how it would work.
With KeePassDX there is an option to ‘Device Unlock Link’ when you enter your credentials. Entering the wrong credentials here will not give you magic access to your DB, just because you have the Device PIN, you still have to have entered the correct credentials (including any keyfile)
One assumes that wherever the secrets are stored, they can’t then be transplanted to another device to unlock a db (ie. in the event that you have access to my filesystem and have copied my db and my secrets file)
i accept the arguments surround compromised fingerprint security, but using a PIN (or alphanumeric password as SF allows) is on a similar level to KDE saving my passphrase and auto unencrypting my backup harddrive.
ETA: KeePassXC allow the same Quick Unlock idea on Windows/Mac KeePassXC: User Guide
although i haven’t integrated it with my Debian setup to know how they do their unlocking
That only would be the case if there would be no real lock to the database? In Windows the feature is achieved by storing a password in a separate db which can be opened by Windows Hello (e.g. pin, face, finger, password). That route seems fully correct to me, as long as it is a local db only accessible on that device, locked by the fingerprint as a password. Maybe even have the db removed / cleared on logout or after x time. This works quite nicely with KeepassXC.
I do agree this introduces a separate security angle (the db itself, and it’s encryption). But it also reduces the chance someone reads your master password.