Possible to be prompted (for a password) before exposing entry?

[bs27975]

Is it possible to be prompted for an entry to be unlocked, prior to exposing (making visible) that particular entry? (Assume database unlocked.) e.g. Suppose I want to force being prompted (again) before credit card details get posted into a web page?

[droidmonkey]

No, that isn't a feature we would implement nor does it make practical sense. If you have super sensitive entries we recommend placing them in a separate database that you only unlock when needed.

[bs27975]

And how would one automate this?

Pardon if some of this is RTFM, I can't quickly find all the bits in there, at the moment.

• I do see the 'Re-lock previously locked database after performing Auto-Type' entry.
• IIRC, an entry can't be auto-found when it lies within a locked database.
• • So the desired entry cannot be found upon triggering auto-type. (?)
• Even if a dummy entry in the opened database is made, for auto-type to find, there is no way to trigger the unlock of a different database. (?)
• • But re-triggering the auto-type would now find it, as the additional database is now open. [Except, there is no way to automate the opening of the additional database, for the entry to be found. (?)]
• • Even if there were, there is no way to cascade down to the now available (just unlocked) entry. (?)
• • • It seems that {O:} references could do the cascade. e.g. via UUID
• I see that Additional {S:} attributes can be used to store stuff (e.g. hints, UUID of entry to cascade to, secondary passwords, etc.), but there is no way to automatically act upon this stuff (?). e.g. Open specified UUID entry in currently unlocked database (which will then auto-lock upon auto-type.)
• Attachments are possible, such as a script file to do extra security/checks, but I see no way for auto-type to auto-open a particular attachment. (?)

If you have super sensitive entries we recommend placing them in a separate database that you only unlock when needed.

Needed == triggered upon auto-type request.
And how would one automate this upon triggering auto-type?

[droidmonkey]

A database needs to be unlocked (perhaps at time of autotype request) before entries will appear in the list.

[bs27975]

Thanks for the confirmation. (Drinking from a fire hose on all this.)

Any way to automate the opening of additional database(s) post keepassxc startup?

• I do see the AutoOpen group description in the docs, for opening at startup.

[bs27975]

Heard.

nor does it make practical sense.

Of course, that's entirely incorrect. But ... heard.

placing them in a separate database that you only unlock when needed.

Which is just redundant to functionality already present, and not actually an answer. But ... heard.

[droidmonkey]

A keepass database is a flat file that is totally decrypted on load. Passwords in that file are encrypted using a separate key, but that is done in line with the total decryption process within KeePassXC. To "protect" access to that information while it is already in memory with a password would necessarily require recoding the entire application to wait for that approval to happen before using any feature that uses a password. It is also functionally equivalent to the existing capability of having two separate databases.

You haven't heard much it seems, but that's OK. You are asking for something that already exists for all intents and purposes. Either locking your database often and unlocking it when needed, or use a separate database.

[bs27975]

You haven't heard much it seems

Incorrect. Response received.

You are asking for something that already exists for all intents and purposes.

If that were self-evident, the question wouldn't have been asked.

A keepass database is a flat file that is totally decrypted on load.

Irrelevant. The question was the question. And, as said, response heard.

How 'bout you just lose the ridicule and sarcasm, here. It serves no one, just wasting eyespace bandwidth.