Does it defeat the purpose of a key file to store it in the same location as the password database? What if a master password is needed also?
For example I save my .kdbx to dropbox as a means to backup and was wondering if I could save the key file too, but then if the dropbox account is compromised they would have both. Does it make sense to have both the key file and .kdbx locally on the same computer, or is this the same as having them both on dropbox?
I think the answer is best summarized by this is a quote from the Another Backup Plugin for KeePass FAQ:
Q: Should I back up my key file the same way I back up my password database?
Short answer: No, no, no! (What part of this answer don't you understand?)
The KeePass documentation also states:
Do not backup the key file to the same location as the database
And later goes into more detail:
Location. The point of a key file is that you have something to authenticate with (in contrast to master passwords, where you know something), for example a file on a USB stick. The key file content (i.e. the key data contained within the key file) needs to be kept secret. The point is not to keep the location of the key file secret – selecting a file out of thousands existing on your hard disk basically doesn't increase security at all, because it's very easy for malware/attackers to find out the correct file
While it may feel comforting to think of all your passwords being encrypted and hence secure, storing the key file with the database really adds little to no security. So using just a key file that is near the database is no security and using both a key file that is near the database and master password is the same amount of security as just using a master password.
The FAQ has further discussion of this if you wish to investigate further.
