Hacker News Reader

Comment by ano-ther | Hacker News Reader

Where is the XML config stored?

If it is backed up with, say, Dropbox, then someone getting access to that could trigger a data export when the user enters the master password next time. And then pick up the data from the synced folder.

This would widen the attack surface from needing local access. Am I missing anything?

View on HN

The XML config file is by default stored locally, as KeePass doesn't support cloud-backup or sync out of the box. If the XML config file is on DropBox, that is because you allowed it (either by uploading it manually or because you enabled sync on a whole directory / directory tree).

If you want to backup or to use the same password file on different computers it's not uncommon to have it uploaded somewhere.

On the other hand a lot of people store dotfiles on the cloud, at which point if somebody gets access it's probably easier to stole the information by modifying something like the .bashrc file.

Then it would be an attack vector of course, but whether it is a vulnerability of the password manager itself would be debatable.

Seems like I was wrong, according to this comment[1] you also need local access to get the passwords after modifying the KDBX file.

[1] https://news.ycombinator.com/item?id=34545504

The passwords store is not the same as the configuration file. It's common to upload the password store, not the configuration.

Reply on news.ycombinator.com