Hello guys

So I asked this question

Seems you guys here think that not using a password and only key files provide no security

Can you explain why/how exactly having a password instead of a key file would help to protect your passwords if your PC/Mobile is compromised already?

I think I'm happy enough with just a key file, it allows me to store my database anywhere and I don't need to remember a long password for it and I can use one-time 200 bits passwords instead of using combinations of the same password

Freedo: The ideal solution you have long key stored on the system and secured it by the simpler password which is computationally hard to find it out (so it's using PKBF, it's random and let's say it's 12 characters which is usually 72 bits). So the keys may be encrypted with AES-128 or 256 and the key for AES is derived from password which takes e.g. 1-2s on your PC to compute.

Freedo: It's actually working slightly different, from the password is derived the key which encrypts another key from the store sometimes so it's like this:

Password -> PKBF -> AES key for AES key -> AES KEY -> Store -> Password, so you can change password without re-encrypting everything and you can have also multiple passwords, e.g. recovery password

With only one copy of the password store