As a noob user of KeePass2 on Windows desktop and Keypass2Android on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store an xml file on Onedrive (at least it looks that way to me).

So I'd appreciate any shared insight on: 1. the nature/extent of risks arising from storing the encrypted kdbx database file along with the xml file (from Keepass2Android??) on Onedrive, and 2. any practical means for a regular user like me to mitigate those risks?

Background/context is that Keepass2 on my laptop is configured to sync the kdbx file (that's stored on my laptop) with an instance stored on Onedrive; and when not at my desktop, I use Keepass2Android on my phone to 'open-up' the sync'd kdbx file on Onedrive to check passwords etc. Thanks in advance.

P.S. As Onedrive doesn't appear to support Yubikey 2FA, I assume that c/b a relavent factor.


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.