Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I ran some advice on the nets:

Don't reuse your passwords. Make sure all the passwords you use are different.
Use a password manager. An example is "Keepass".
Set the master password to something very strong, like:
"This is a super secure passphrase because it's crazy long"
Then paste all of your unique passwords into the manager.
Keep the password manager installed on a thumb drive. 
Encrypt the thumb drive with something like TrueCrypt or PGP.

I had a few questions like:

  1. Is this sound advice?
  2. Do I need TrueCrypt on every computer I use my drive on? How does that work?
  3. If my KeePass has a long password do I really need to Encrypt my Drive?
  4. If Yes can somebody walk me through encrypting my drive via TrueCrypt?
share|improve this question
2  
Mostly yes. But I'm not sure this question is a good fit for this site; it's awfully broad. – tylerl Jan 9 at 7:57
I suppose so if TrueCrypt Encryption is not common. Otherwise I don't see why Encrypting Portable Data doesn't fall under IT Security. – Howdy_McGee Jan 9 at 8:45
Discussion of specific uses of data encryption certainly does. Questions 1 through 3 are reasonable here. Question 4 doesn't belong here, but there's a tutorial at the Truecrypt website. – Jonathan Garber Jan 9 at 13:58
..And more importantly, you're not asking 1 question, you're asking 4 very different and disconnected questions. – tylerl Jan 9 at 16:29
Would you rather me make 4 separate questions on this sub then? – Howdy_McGee Jan 9 at 20:55

2 Answers

up vote 5 down vote accepted
  1. Yes.
  2. No, TrueCrypt supports portable installation (running it from USB drive without installation).
  3. Yes, KeePass.exe can be modified in order to sniff on your database password or dump your decrypted database. Make sure you have a different passphrase for TrueCrypt volume and KeePass database! Furthermore, enable "Enter master key on secure desktop" option in KeePass as it will stop some keyloggers from getting your database passphrase.
  4. No, it's very simple and I'm sure there are plenty of howto/guides on Internet.
share|improve this answer
See that's what I thought but I guess what I don't quite understand when it comes to the tutorials is; Am I encrypting my Password Database File or my Entire Portable Drive? – Howdy_McGee Jan 9 at 8:47
1  
KeePass will encrypt your password database and TrueCrypt will encrypt the TrueCrypt container file inside of which you have your KeePass stuff including keepass.exe and database file. TrueCrypt container is a file that will reside on your USB drive. Using TrueCrypt is entirely optional and while it does increase security, it hampers usability, so unless you are a likely victim of targeted attack, you should be fine with only KeePass. – Matrix Jan 9 at 9:31
1  
One more thing. Using a USB key that has a physical write lock switch will increase security. When write lock is in place, data on USB key cannot be changed until write lock is physically disabled. This means that as long as you have physical control of the key, you can be sure about its integrity. – Matrix Jan 9 at 9:34
1  
@Matrix - how would encrypting the drive prevent someone from sniffing the database password or dumping the decrypted database? I guess it would prevent tampering with the executable while the drive isn't decrypted, but any compromised system could simply compromise the executable as soon as it is unlocked couldn't it? Or does TrueCrypt support some separate password to store secure cryptographic hashes of files to ensure they haven't been changed even when they are accessible on the drive? (And/or a separate password for allowing write access to individual files.) – AJ Henderson Jan 9 at 14:12
@Matrix - also, couldn't truecrypt be modified in a similar way? – AJ Henderson Jan 9 at 14:14
show 2 more comments
up vote 3 down vote

  1. It certainly is sound advice, you aren't going to be opening yourself to anything I can see from following it, but it might be overkill depending on your needs.

  2. No, there is a portable option that basically puts the files necessary to access the encrypted partition on the drive in an unencrypted format. When you insert the drive, it has the software there needed to access it.

  3. While this claim should theoretically add a marginal level of security, it seems like overkill to me. The KeePass database is already protected and while encryption would protect the KeePass executable from modification, using a portable TrueCrypt installation seems to just move the burden out to either compromising the TrueCrypt client in a similar way or simply waiting until the drive is unlocked to compromise the KeePass client. If your client is that thoroughly compromised, you are likely boned already and should change your passwords and start over as well as nuking the client from orbit. Having a write lock on the drive would be a MUCH better option as you could put it in read only mode when accessing it on an unknown computer and only update on trusted hardware.

  4. I don't personally use TrueCrypt and there are guides on their site for how to do it if you want to go that route.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.