Yubikey oder Nitrokey kaufen?

[porcupine0815]

@NSA

Das wäre tatsächlich ein K.-o.-Kriterium.

Du solltest aber wissen, daß der Yubikey beim Öffnen der KeepassXC-Datenbank nicht als „echter“ 2. Faktor funktioniert sondern „nur“ 160 weitere Bit zum bestehenden Masterpasswort hinzufügt.

https://keepassxc.org/docs/#faq-yubikey-2fa

und

@Janek Bevendorff KeePassXC developer

It adds 160 pseudo-random bits to your password, which on its own is already stronger than most users’ passwords (especially considering that most passwords are vulnerable to dictionary attacks). Used in combination with a strong password or passphrase and Argon2 as your KDF, it makes your database very resilient against any kind of brute-force attack. As an attacker, you are probably better off guessing the transformed 256-bit AES key instead.

Auf einem komprommitierten System schützt Dich der Yubikey aber auch nicht mehr.

@Janek Bevendorff KeePassXC developer

The YubiKey response does not appear on-screen and does not use a conventional keyboard interface. This is not really a security property, but it can sometimes help if your system is compromised with a generic key logger that does not intercept all USB inputs. Of course, a more specialised key logger can totally intercept the YubiKey response, and hence I would not trust this as a defence measure, but in some cases it may help. In general, however, expect your data to be lost if you have malware on your system. The only thing you can try in that case is damage mitigation, but overall, a compromised system is not your system anymore, so don’t expect there to be any effective counter measure against key loggers other than not getting one in the first place.

Ich hatte auch schon mal über einen Yubikey für KeePassXC nachgedacht aber die Idee wieder verworfen, weil alle Szenarien bei denen ein Yubikey mich besser schützen würde als Passphrase/Keyfile extrem unwahrscheinlich sind.

Natürlich gilt, wie immer, „Your System, your rules“

Die Quotes von Janek Bevendorff stammen von
https://security.stackexchange.com/questions/201345/is-it-reasonable-to-use-keepassxc-with-yubikey?answertab=createdasc#tab-top