> Still, it does require the attacker to either have root on your machine or physical access to your disk. If the attacker has root on your machine, it's game o

> Still, it does require the attacker to either have root on your machine or physical access to your disk. If the attacker has root on your machine, it's game over anyway. How does Windows enforce signing these days? If I run "keeppass_compiled_by_attacker.exe" do you get some sort of prompt? Without it, even with local user access it's kind of "game over"; there's nothing preventing the attacker from replacing the desktop or start menu shortcut to their own wrapper or own version which steals the master password. No modification of system files or special access to memory or whatnot needed. And even with it, many users will likely just click through the warning. On Linux and other Unix-like system this is certainly an issue. Sometimes I think people are a bit too focused on these kind of complex and advanced exploits, while in reality it turns out you often don't need them to do malicious stuff.