3 ms·

So, a MITM would be able to prevent automatic update notifications?

• dchest 10y ago
  Yes.
• sooper 10y ago
  It seems not any more?: "Resolution. In order to prevent a man in the middle from making KeePass display incorrect version information (even though this does not imply a successful attack, see above), the version information file is now digitally signed (using RSA-2048 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS."
  • dchest 10y ago
    The question was if MITM would be able to prevent automatic update notifications. Their solution doesn't solve this: it prevents attackers from changing version information, but doesn't prevent them from replaying previous version information.
    • SNvD7vEJ 10y ago
      How would that work? ("replaying")