Gander5739

Without wanting to sound too critical, that sounds like you're trusting vibes over statistics.

> Right now I see no compelling reason to switch from regular OTP codes. Change my mind.

The phishing potential?

Well, KeePass is self-hosted, and I hadn't heard of strongbox before, but it says on the website:

> Store your data anywhere you like, online or offline. Sync with every major cloud storage provider or your own server over WebDAV or SFTP. Use your Strongbox database with any KeePass compatible client on any platform.

> Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.

Is this really true? After all, reselling the exploit would be illegal, and most people don't want to break the law to earn income.

Surely at least some part of this is confirmation bias?

I believe the image would need to be present in the full size image, so I think that would limit to some extent the attack vector, but I don't know how far you could push it.