KeePass has the option for a master password and key file (and windows login). But I am not sure how it really helps security that much.
I can see a couple of scenario's:
- The database and key are on one system: basicly a open door.
- The PC is yours and the datbase is on it, and the key is on a usb stick: secure as long as your system it not compromised.
So only if you use a USB Stick it's secure-ish. But it isn't (meaningfully) more secure than just having a password right? Remembering a single complex password is quite possible. And if it takes over a lifespan to bruteforce the complex password, it's not that meaningful that the keyfile has a longer and more complex password, right?
And if the system is compromise it doesn't really matter either way. Only one time password could protect against that.
So am I getting this completely wrong and is the keyfile in fact more secure? Or is it more of a thing where some people prefer sticking a USB stick in their PC instead of typing a password?
And lastly, since you can use both, is there any point to having both a keyfile and master password if I am unwilling to plug the USB stick in and out (thus leaving the keyfile on the harddrive (or letting the USB stick stay connected 24/7)? Or would that render it nothing more than a little security through obscurity?