3 ms·
Application directory and Application Settings directory are not the same thing, usually. (Indeed usually on Windows and Linux, the former isn't writeable to th
by detaro 4y ago
Application directory and Application Settings directory are not the same thing, usually. (Indeed usually on Windows and Linux, the former isn't writeable to the user account without elevating privileges, the latter is)
- wcoenen 4y agoI checked where the relevant files are when installing KeePass 2 for windows. There is a global configuration file at "C:\Program Files\KeePass Password Safe 2\KeePass.config.xml" but by default, this one just contains a directive to use the user's configuration. This one also needs elevated privileges to edit. The user's configuration file is at "C:\Users\<username>\AppData\Roaming\KeePass\KeePass.config.xml" So if you want to avoid an attacker being able to change the user's configuration without elevation, then you can just change the security settings of that last file, e.g. by taking away the user write permission. However, the user is probably launching the KeePass executable via some sort of shortcut. For example, a pinned shortcut on the taskbar. This would also be a user file, at "C:\Users\<username>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\KeePass 2.lnk" So if the attacker can modify the user's files, then they can probably also modify that shortcut, e.g. to point at a modified copy of keepass. This shows that the behavior of the "real" KeePass application is probably not very relevant here. It is difficult to defend against an attacker with that level of access.