If I change the extension of a Keepass database (i.e. change the
.kdbxto something like
.txt), Keepass is still able to open it. Is this an effective way for hiding the databases from an adversary?! Probably no. So, what methods are there for hiding such files? What do you experts think about OpenPuff?
Is there any method to truly hide a (normal) Truecrypt container, so that its existence would be undetectable? Note that I'm not talking about "Hidden Truecrypt volumes."
2) In theory, yes. A Truecrypt container, considered in the abstract, is indistinguishable from random noise. In the absence of something pointing to the file and saying "this is a Truecrypt container" (eg. a recently-used files list), an attacker cannot prove that a given file is a Truecrypt container.
In practice, no. Normal people do not carry around large blocks of random data on their computers, so a large file that is statistically indistinguishable from randomness and does not have is almost certainly an encrypted file. If someone has a large random file and the Truecrypt software on their computer, it's a good bet that the file is a Truecrypt volume.
1) I'm not familiar with OpenPuff, but in general, I distrust steganograpy. The data you're trying to hide rarely has the same statistical properties as the data you're hiding it in, eg. the well-known "hide the data in the low-order bits of an image" trick fails if the image has large areas of solid color (such as a cartoon) or the low bits are biased in non-random ways (as is common with digital cameras). The best place to hide a needle is not in a haystack, but in a pile of other needles.
One possible way of hiding a file is saving it, where noone will find it. May be on a flashdrive hidden in your flat or on some Server on the Internet (an anonymous Webmail maybe). Make sure to securely delete it, if you need in on your hard drive temporarily.
The fact that it's hard to hide the data is the reason why "hidden volumes" where invented. There is a Password Manager in development, that can hide stuff in your encrypted password-file. https://github.com/bwesterb/pol