In such a situation, is there a way to still use KeePass, but protect against specialized attacks?
Absolutely; the simplest and most basic is called "air gap" protection.
- Take a computer with no network connection, no speaker, and no microphone, such as a Raspberry Pi 2.
- Use wired keyboards, mice, monitors, etc. No wireless anything!
- Set it up with the minimum required software - if you insist or for a basic proof of concept, you can start with NOOBS Raspbian.
- Patch it, ideally offline (see below for one-way transfers), but you could do it online before you actually start using KeePass at all
- Fill the ethernet jack with epoxy; it is NEVER to be used.
- Install KeepassX
- NEVER AGAIN move any data off this machine in any electronic way. Updates can go in, but nothing comes out electronically. Read the screen and hand-type.
- burn CD-ROMs with whatever updates you need to move to the KeePass only machine and then use a USB CD-ROM to read them, then shred the CD (just in case something got written to it).
- or use something like an Apricorn flash drive; wipe it, set a password, put the data on it, enter the password and use it on the KeePass machine, then immediately wipe it again BEFORE it goes in any other machine.
- For the truly paranoid, use a dedicated monitor, mouse, and keyboard that never get used for anything else; the older and less advanced the better.
- Don't use it where any electronic cameras - like your laptop/webcam/fancy video conferencing monitor - can see screen emissions.
This way, even assuming that some specialized software gets onto the machine, someone has to be in reasonable physical proximity to be able to extract data; hear the sounds the chips and/or power supply make, watch thermal patterns, see the emissions from the machine, monitor, keyboard, etc., but the machine itself has no networking or radios at all - no bluetooth, no wifi, no cell modem, no ethernet cable, etc.
CRITICAL - back up that KeePass file regularly to something like an Apricorn mentioned earlier, or paper (dedicated printer, no networking, no wireless capability), etc.
CRITICAL if using a Pi - run that Raspberry Pi on a UPS of some sort - Raspbian reacts very badly to sudden power loss while turned on some of the time.