We’re rewarding the question askers & reputations are being recalculated! Read more.
2 clarified that the eamples are hypothetical.
source | link

Short answer:
it's probably fine, but make sure to regularly delete really old files.

Long answer:
There is a few reasons why it could be a problem. To illustrate some cases, let us assume an attacker gets hold of all these files, rather than just one (i.e., the most recent one). What could cause your approach to be less secure? Here are some hypothetical possibilities (that could become real in the future):

  • There was a vulnerability in an earlier version of KeePass, which was since patched, but that stored data in an insecure way. This could lead to the passwords up to that version being compromised, while deleting the older ones would have no effect.

  • KeePass encrypts the passwords, but has some cryptographically weak way of storing the passwords. For example, lets say it does not use randomized encryption. This means that an information leak exists: the attacker could see when accounts were added or removed, by looking at the difference between files (assuming the order of the passwords remains the same).

The KeePass wikipedia page only says that AES or TwoFish can be used as cyphers. These can be considered secure, but the bigger question for the above is how they are used. There are many more potential cryptographic vulnerabilities that could exist (just look at the problems we saw in recent years with SSL/TLS). However, those are likely to be theoretical in nature, and likely to affect both the case where you only have one file, and the case where you have multiple. Thus, unless you're storing extremely sensitive passwords, keeping a few backup files probably doesn't hurt.

Short answer:
it's probably fine, but make sure to regularly delete really old files.

Long answer:
There is a few reasons why it could be a problem. To illustrate some cases, let us assume an attacker gets hold of all these files, rather than just one (i.e., the most recent one). What could cause your approach to be less secure?

  • There was a vulnerability in an earlier version of KeePass, which was since patched, but that stored data in an insecure way. This could lead to the passwords up to that version being compromised, while deleting the older ones would have no effect.

  • KeePass encrypts the passwords, but has some cryptographically weak way of storing the passwords. For example, lets say it does not use randomized encryption. This means that an information leak exists: the attacker could see when accounts were added or removed, by looking at the difference between files (assuming the order of the passwords remains the same).

The KeePass wikipedia page only says that AES or TwoFish can be used as cyphers. These can be considered secure, but the bigger question for the above is how they are used. There are many more potential cryptographic vulnerabilities that could exist (just look at the problems we saw in recent years with SSL/TLS). However, those are likely to be theoretical in nature, and likely to affect both the case where you only have one file, and the case where you have multiple. Thus, unless you're storing extremely sensitive passwords, keeping a few backup files probably doesn't hurt.

Short answer:
it's probably fine, but make sure to regularly delete really old files.

Long answer:
There is a few reasons why it could be a problem. To illustrate some cases, let us assume an attacker gets hold of all these files, rather than just one (i.e., the most recent one). What could cause your approach to be less secure? Here are some hypothetical possibilities (that could become real in the future):

  • There was a vulnerability in an earlier version of KeePass, which was since patched, but that stored data in an insecure way. This could lead to the passwords up to that version being compromised, while deleting the older ones would have no effect.

  • KeePass encrypts the passwords, but has some cryptographically weak way of storing the passwords. For example, lets say it does not use randomized encryption. This means that an information leak exists: the attacker could see when accounts were added or removed, by looking at the difference between files (assuming the order of the passwords remains the same).

The KeePass wikipedia page only says that AES or TwoFish can be used as cyphers. These can be considered secure, but the bigger question for the above is how they are used. There are many more potential cryptographic vulnerabilities that could exist (just look at the problems we saw in recent years with SSL/TLS). However, those are likely to be theoretical in nature, and likely to affect both the case where you only have one file, and the case where you have multiple. Thus, unless you're storing extremely sensitive passwords, keeping a few backup files probably doesn't hurt.

1
source | link

Short answer:
it's probably fine, but make sure to regularly delete really old files.

Long answer:
There is a few reasons why it could be a problem. To illustrate some cases, let us assume an attacker gets hold of all these files, rather than just one (i.e., the most recent one). What could cause your approach to be less secure?

  • There was a vulnerability in an earlier version of KeePass, which was since patched, but that stored data in an insecure way. This could lead to the passwords up to that version being compromised, while deleting the older ones would have no effect.

  • KeePass encrypts the passwords, but has some cryptographically weak way of storing the passwords. For example, lets say it does not use randomized encryption. This means that an information leak exists: the attacker could see when accounts were added or removed, by looking at the difference between files (assuming the order of the passwords remains the same).

The KeePass wikipedia page only says that AES or TwoFish can be used as cyphers. These can be considered secure, but the bigger question for the above is how they are used. There are many more potential cryptographic vulnerabilities that could exist (just look at the problems we saw in recent years with SSL/TLS). However, those are likely to be theoretical in nature, and likely to affect both the case where you only have one file, and the case where you have multiple. Thus, unless you're storing extremely sensitive passwords, keeping a few backup files probably doesn't hurt.