> But it emphatically does not protect against keylogging 1. A keylogger on your password db is useless if it does not also upload the db (at which point you'r

> But it emphatically does not protect against keylogging 1. A keylogger on your password db is useless if it does not also upload the db (at which point you're looking at a targeted attack, and you have far bigger problems than that). 2. Keyloggers are more and more often browser-based. KeepassXC is immune to those. 3. KeepassXC supports 2FA for the database encryption itself. If you're that paranoid, use that. There's always more you can do. > And so, the responsible advice is to not use it. No. Just as you see in the article where Troy has to make the difficult decision not to include a "Do not put your password anywhere not even here" disclaimer, the same holds in my message: I weigh the pros of someone turning 2FA on as far more important than the cons that come with the less-than-ideal security 2FA adds. Your advice keeps people from turning 2FA on. 2FA is a pain in the ass for most people. You are one of the lucky few who understands the tradeoffs involved, as you yourself said. So use that knowledge of yours to actually get people to secure their accounts. My goal isn't to keep Edward Snowden's accounts secure. It's to keep the bored HN user's account secure. The average HN user has medium-to-high technical literacy and low-to-medium security literacy. A lot of people on here reuse passwords, I'm sure. This is what I'm trying to fix, and I won't advise Ed to keep his TOTP seeds in the same database.