Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag. The https thing is unfortunate and should be fixed,

Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag. The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo. The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw). I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.