Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm starting a new website project where I have many passwords (root,sql,wordpress, etc). I have a USB stick encrypted with TrueCrypt with a file of all my passwords. But I also want to be safe if i open the file and type it into the Internet. Of course it would be possible to store them on some paper but some kind of keylogger or whatever would not keep my passwords secure. That's why I've been thinking of some secure Virtual Machine. Windows 8 with AntiVir software and firewall but else usual use. In the OS a secure VM. Would that be a safe setup or as safe as without VM?

share|improve this question
add comment

closed as not a real question by TildalWave, Lucas Kauffman, Xander, Scott Pack, Terry Chia Jun 25 '13 at 15:28

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers

If you're concerned about the passwords for managing your website or business here's the approach I'd recommend.

  • Have an entirely separate physical machine for management work. Do not use it for any other tasks (e-mail, website browsing etc etc).
  • Don't install any other software onto the device (e.g. Java, adobe acrobat, flash) unless needed.
  • Ensure that it's got up-to-date firewall and anti-malware protection.
  • Use an encrypted container for your passwords.
  • Keep the devices in a locked drawer or cabinet when not in use.

the problem with using a Virtual Machine instead of a physical machine is that a keylogger on the host Operating system may well still get your passwords.

share|improve this answer
add comment

I don't really understand what you are trying to achieve here, even if you set up a "secure" VM you will still need to type the password into your applications, regardless if you store it in an encrypted file, password manager or a virtual machine.

If you say you don't trust all machines where you need to input or save your passwords then I suggest not using the machine at all.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.