tpm-fido VS keepassxc

I also found this: https://github.com/psanford/tpm-fido

FIDO2 should be used more, hopefully more sites end up supporting it sooner rather than later.

If you have a Linux PC with a TPM, you can use https://github.com/psanford/tpm-fido to create and "plug in" a virtual USB WebAuthn key whose secret is irretrievably stored in the machine's TPM. This effectively asserts that your specific machine is being used to enter a given site. However, it's important to remember it doesn't necessarily verify that *you're* present, or even if *anyone* is present at all, since the presence check is done via a software dialog and can be pwned along with the rest of the system.

There are a huge number of other vendors supporting Webauthn apart from Yubikey. (From the top of my head Nitrokey, Solo, Tomu, Mooltipass, Ledger, Trezor, Google Titan, OnlyKey, Token2).

You could also use the system TPM (https://github.com/psanford/tpm-fido).

A brief search didn't yield any FIDO2 software-only solutions for Linux, but I see no reason why in principle you couldn't implement it (perhaps interfacing https://github.com/google/OpenSK through hidg - similar projects do exist for U2F).

I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido

KeepassXC supports exporting, but i don't think it is released in a stable version / to the public yet:

https://github.com/keepassxreboot/keepassxc/pull/8825

If you use KeePass, make sure you use the KeePassXC variant. KeePass is dead.

https://keepassxc.org/

That's why you use the superior one, KeePassXC, as linked in the NIST link: https://github.com/keepassxreboot/keepassxc/discussions/9433

Over there, they got pissed about people constantly bugging them about it and closed the bug with the last comment reading:

for the internet, use a password manager like keepassxc with a strong password.

Another regression is that KeePassX/C AutoType doesn't work with Wayland, so now instead of a simple CTRL+V in KeePassXC, I have to separately copy and paste the user and the pass.

https://github.com/keepassxreboot/keepassxc/issues/2281