One of the attacks is registering a debugger for KeePass.exe which would completely replace KeePass.exe with something else, potentially a very good copy that I don't recognize. Instead of 9 characters, how about 13+? Instead of just lower letters only, what about including uppercase and even a special character or two too? The more unpredictable and longer your password is, the longer it will take for your attacker to brute force the database master key. You know the drill: install and update your AV software, keep your computer OS and software updated, have a firewall, review logs regularly etc.įinally, increase the entropy and length of the master password used. To prevent malicious access to the KeePass database (and your decryption passphrase, since you need to type it in plaintext somehow.and that can be intercepted if your computer is compromised) in the first place, keep your computer secure. It should prevent crude key loggers from retrieving the specific password you use for that site. There is also an option to set two channel obfuscation during auto type when KeePass does the typing of the username and password for you.

To prevent someone from getting your KeePass database file and performing brute force on it, you can also increase the AES iteration count that KeePass does during the master password derivation process, so as to increase the effort require to brute force the master key should your database be exfiltrated. There are ways to increase the difficulty of retrieving the KeePass master password, such as setting it to allow entry on the secure desktop only.

Keepass portable linux