Posted December 26, 2015
Sure running known software means you're more likely to get pwned. But for cracking KeePass someone would most likely need to either a) get your keepass file and password or b) get malware on your computer which includes a keylogger.
Either way, if you get that far, you're SOL. If your passwords reside in a plain text file somewhere, anyone with malware monitoring your computer could likely tell the file is opened shortly before password entries are made and certainly read the passwords for various things as you enter/paste them.
Security through obscurity is oft cited as a horrible thing. If it's your only line of defense (password file) then yes it's horrible. If it's combined with some good actual security it suddenly starts making more sense. A way to increase security for KeePass and other security softwares would be for people to compile it themself, having a buildscript create executables with different names and locations for different people, maybe some code-based salt added to the file scheme. That's about as safe as you can get unless you take it completely off your computer.
