Zinggi

Thank you! Well put.

> the Android app requires no device permissions

That's not true, it just uses the new way to ask for permissions. E.g. when you want to scan a QR code it requires the camera permission. But it only asks at that moment, not upfront as older android apps used to do

Yep, from a user perspective it definitely looks like 2FA.

In terms of technology it's of course completely different.

Ah ok, got it. If you are already using KeePass than there is no reason to use NoKey, KeePass is great!

> Not everyone has a million devices.

I don't think that's fair. With 3 devices you're perfectly ok. Or even with only 2, if you also use a "key box" (gives you one "device" more at the cost of having to remember a password).

But wouldn't you agree that your brain + NoKey instead of a piece of paper as a backup would be more secure? And more convenient, as you don't have to type your passwords anymore.

I don't wanna push you, just wanna give you some things to think about. As long as you use strong and unique passwords everywhere you're good.

Also, it's not a big problem if one of your devices dies, as long as you paired enough devices you won't lose any passwords.

Exactly. Or even 3 if you make use of security level 3.

The only exception is at the start when there are no passwords stored yet.

When pairing a new device (or in this case a new browser), that device doesn't automatically get any keys! When adding a new device, to complete the setup you also have to be able to unlock a password group, for which you need another device that already has keys.

In short, a new device doesn't have the same power as the others from the start, first new keys have to be generated which can only happen if you are able to unlock your passwords.

So just don't setup both the Firefox and Chrome extension and you're golden.

Yes, but it's a very bad idea. If you'd do this, you could unlock your passwords with a single device by confirming on Firefox or vice-versa on Chrome. This of course also means that if someone steals this device, they can unlock it too.

So don't do it.

Oh, than I misunderstood, sorry. You're absolutely correct.

Thanks. I was always wondering why others don't do this more often. I find it much easier to remember and type in a few words compared to a long number.

> Doesn't this increase your attack surface greatly though?

That's true. I suppose it's a trade off between protection against lost vs. smaller attack surface.

> Since there's no master key, one has to only compromise the OS to get at everything

That's wrong, compromising one device doesn't give an attacker anything useful. Only if two or more devices have been compromised can passwords be decrypted. But in any case, I think if your device is compromised you might be in bigger troubles anyway. E.g. if an attacker controls your device, ransomeware might be easier and more lucrative to them than going after more devices to hunt for passwords.