As a noob user of KeePass2 on Windows desktop and Keypass2Android on my phone, supplemented by YubiKey Neo configured for hmac-sha1 challenge response, I noticed that Keepass2Android appears to store an xml file on Onedrive (at least it looks that way to me).

So I'd appreciate any shared insight on: 1. the nature/extent of risks arising from storing the encrypted kdbx database file along with the xml file (from Keepass2Android??) on Onedrive, and 2. any practical means for a regular user like me to mitigate those risks?

Background/context is that Keepass2 on my laptop is configured to sync the kdbx file (that's stored on my laptop) with an instance stored on Onedrive; and when not at my desktop, I use Keepass2Android on my phone to 'open-up' the sync'd kdbx file on Onedrive to check passwords etc. Thanks in advance.

P.S. As Onedrive doesn't appear to support Yubikey 2FA, I assume that c/b a relavent factor.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.