[Windows] Private Key file as a Temporary file is accessible by every user by default

[Chocaute]

Greetings,

Case in point,

I know this is a temporary file, but doesn't this defeat the point of KeePass?

For context, I used this feature as a step to stymie having lots of SSH keys loaded at once.

EDIT: Turns out "IdentityFile C:\path\to\hostsKeys\%h" and "IdentitiesOnly yes" in my ssh config file can handle this particular problem just fine. As an added bonus, KeeAgent doesn't blast all of its public keys to untrusted servers anymore. I've elected to leave my keys where they are, to manage new key passwords with KeyPass and use KeeAgent as automatic login.

I feel like my original point still stands, but if it's working as intended, feel free to close this issue.

[Gnarfoz]

Note: SYSTEM is the highest privileged user on Windows. You seem to have it mixed up with Everyone?

[Chocaute]

Note: SYSTEM is the highest privileged user on Windows. You seem to have it mixed up with Everyone?

Not at all, I was just kind of miffed that one of my private key file was accessible to every user on my system (Which is me and my brother) in some temp folder.

It's not that it's an actually issue, but shouldn't private key files be only accessible to its owner?

[Gnarfoz]

Your screenshot does not show which privileges each of those users has, though. What do the privileges for Arian and Willy look like? I recommend looking in the advanced settings.

I tried reproducing this. I created an additional local user and turned on that option to save the attachment to a temporary file. The "KeeAgent" folder in my %temp% folder, as well as the temporary file within it, exclusively have inherited permissions, no explicit ones: No sign of the other user I created.

Most likely, you granted access to the other user at some point in the past.