3 ms·
Where is the XML config stored? If it is backed up with, say, Dropbox, then someone getting access to that could trigger a data export when the user enters the
by ano-ther 4y ago
Where is the XML config stored?
If it is backed up with, say, Dropbox, then someone getting access to that could trigger a data export when the user enters the master password next time. And then pick up the data from the synced folder.
This would widen the attack surface from needing local access. Am I missing anything?
- vgalin 4y agoThe XML config file is by default stored locally, as KeePass doesn't support cloud-backup or sync out of the box. If the XML config file is on DropBox, that is because you allowed it (either by uploading it manually or because you enabled sync on a whole directory / directory tree).
- Ambolia 4y agoIf you want to backup or to use the same password file on different computers it's not uncommon to have it uploaded somewhere. On the other hand a lot of people store dotfiles on the cloud, at which point if somebody gets access it's probably easier to stole the information by modifying something like the .bashrc file.
- vgalin 4y agoThen it would be an attack vector of course, but whether it is a vulnerability of the password manager itself would be debatable.
- Ambolia 4y agoSeems like I was wrong, according to this comment[1] you also need local access to get the passwords after modifying the KDBX file. [1] https://news.ycombinator.com/item?id=34545504 https://news.ycombinator.com/item?id=34545504
- marcosdumay 4y agoThe passwords store is not the same as the configuration file. It's common to upload the password store, not the configuration.