Protect settings with password

[eike-fokken]

Summary

An attacker that has brief access to my computer with unlocked screen but locked database could go to settings and disable the automatic locking of the database, hoping that I later open the database, thinking it will lock itself afterwards, and briefly leave my computer.

Desired Behavior

It is not easily possible to change program settings.

Possible Solution

Add a password before the settings.

Context

Its just paranoia.

[droidmonkey]

The only way this would work is if we encrypted the settings file itself and you had to enter a password just to even open KeePassXC. Given the fact that you gave access to your computer (willingly or not) to someone else is the problem here.

[eike-fokken]

I agree that it is a bad idea to do that. On the other hand I have the impression that if I have security settings I should be able to rely on them.

What do you think about providing a (possibly red) warning stating that settings have changed when opening a safe the first time after changing settings?
This is probably also hard to implement rigorously, as the information when a safe was opened the last time, would be equally easily forged.

[droidmonkey]

We have tossed around the idea of database specific security settings (ie they are stored in the encrypted database). Also we have an issue to implement enterprise settings via registry key or specific ini file.

[eike-fokken]

I like this idea of settings stored in the database very much.

[droidmonkey]

See #891 and #2189