search

keepassxreboot / keepassxc

KeePassXC is a cross-platform community-driven port of the Windows application “Keepass Password Safe”.
https://keepassxc.org/
Other
21.27k stars 1.47k forks source link

Path to DB is shown to anyone looking at the client #8510

Closed skossan closed 2 years ago

skossan commented 2 years ago

Overview

The location of my database is clearly shown in plain text when I am about to enter my password to unlock my database. The location string is shown right under where it says Unlock KeePassXC Database

Steps to Reproduce

See the previous point.

Expected Behavior

I would assume this information would be hidden. It provides no benefit to show this information publicly to anyone looking at the computer screen. If someone gets unauthorized access to my machine they will instantly be able to find my database file.

This information is better shown in the settings menu.

Additional info.

KeePassXC - 2.7.1 Operating System: Windows Windowing System: 11

michaelk83 commented 2 years ago

It provides no benefit to show this information

Sometimes it's needed to identify which database file you're trying to open.

If someone wanted to find your database, they could simply run a search, starting from the most common locations (documents, downloads, network shares, KeePass folders), so there is no benefit to hiding this information. Even if they got the file, if you use a strong enough passphrase, your passwords would still be safe, so it doesn't matter (unless they just delete the file - it's always a good idea to keep backups).

Also, if someone gets unauthorized access to your machine, you could easily have bigger problems to worry about.

droidmonkey commented 2 years ago

Where your database file is stored is irrelevant. One with said access to your computer can also just search for kdbx files. Or more likely just dump all your files and walk away when done.