Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the past I have seen having a Google drive document and have FTP username/passwords there.

Is storing passwords in Google drive a good practice?

share|improve this question
2  
See security.stackexchange.com/questions/62599/… for some related issues. –  Mark Aug 12 at 19:26
4  
In a reasonably simplified way, I would say that the only moment one should send his credentials online is when one authenticates with them (over a safe connection being an even more satisfying scenario). –  John WH Smith Aug 12 at 21:17
1  
@JohnWHSmith I disagree. You should never need to send your credentials online for authentication. The only time you should have to send them credentials in a reversibly encrypted form is when creating the authentication account in the first place. –  Aron Aug 13 at 3:06
    
Using a password manager while having your password database stored on Drive is a win-win-win situation: Google can't divulge your credentials even if they wanted to, you maintain the convenience of easy access, and you are also reasonably protected against downtime (typically there will be several offline copies of the password database stored among your devices). –  Jon Aug 13 at 11:58
1  
Sophos have a good rule for this: In a security context, read "cloud service" as "someone else's PC". So to reword, is it a good idea to keep a list of your passwords on someone else's PC? –  Chris Murray Aug 13 at 15:29

8 Answers 8

Is Google Drive safe?

I wouldn't say that Google drive is not a safe place to store sensitive information. But I bet you cannot rely on it. When it comes to protecting your sensitive data/privacy, it is always good to be sure, and just trusting drive is not being "sure".

Solution:

One word, Encryption.

Encrypt your data before you store them in the Google drive. Now you don't have to depend on Google to protect your data security, it is you who should keep your mouth shut about your key ;)

Note:

Encryption is not always needed when storing normal data which falls under the general category(something like the things you share in the social networks,etc.)

But it is really a great option when it comes to storing your confidential information in drive and in my experience, I am pretty sure that passwords fall under this category.

share|improve this answer
    
Agreed, I store all manner of sensitive information on Google drive - in encrypted documents –  Carson63000 Aug 12 at 12:46
    
To automate this process there is a program called duplicity, it will only record the parts of files that have changed since the last backup, and encrypts locally before transferring. For an example see shobute.com/posts/backup-to-google-drive-with-duplicity. –  Ben Aug 12 at 20:40
    
Given the "amount" of data being stored on Google Drive, we would be approaching OTP encryption level (password protecting a password). Assuming OTP level encryption, then the problem is reduced to storing and protecting a password securely. Which happens to be the SAME problem we were trying to solve. –  Aron Aug 13 at 3:10
1  
and where do I store that key?? –  Awal Garg Aug 13 at 8:11
1  
@Damon Ease of access! I agree that confidential data are worth spending time in encryption/decryption.But if the user have to decrypt every single time he needs to access anything(even things like the user's social media pictures which is already available in the internet for the whole world),then eventually he/she is gonna get sick of the process which might result in giving up the whole encryption step to make life easier.Trust me, no security method is really worth it, if it degrades the user experience. So it is recommended to use security methods only if there is a need for security. –  Ebenezar Aug 14 at 12:15

Quick answer: NO.

If you ever decide that you will automatically log-in to google drive on your device, anyone with access to your machine has access to your passwords.

If you want to store passwords I think you might be better off using a password manager.

Check this list: http://www.pcmag.com/article2/0,2817,2407168,00.asp

share|improve this answer

Only if you trust Google with that information. This is because in all likelihood Google has access to everything in your Google drive and can extend that access to anybody given a court order to do so.

As for if this is good practice...no, it's not.

share|improve this answer
8  
... can extend, and can be forced to extend, ... –  O. R. Mapper Aug 12 at 13:31
    
google does not have access to anyone's drive. I had to work with their support and had to explicitly share the files with google in order for them to see it. –  matejkramny Aug 12 at 15:37
12  
@matejkramny I can see where you are coming from but in the end your data is on their servers to which they control access and which can be decrypted server side. I have no doubt that should they be ordered to, they can access your data. I think in your case it is true that the support personnel do not have direct access to your data on your drive and I support that completely, but I am fairly sure that a bit further up in the management hierarchy there are people with the authorization to access your data. –  ilikebeets Aug 12 at 15:48
1  
@ilikebeets Hmm good point. They're probably compliant with many secret three-letter-agencies.. –  matejkramny Aug 12 at 15:50
3  
@matejkramny: Eh? It's their drive! Of course they have access to it. Whether a frontline support tech has access to the backend servers is an entirely different thing. –  Lightness Races in Orbit Aug 13 at 15:06

A good rule of thumb is: if you don't want to risk other people seeing it, don't put it online. This especially goes for passwords.

If you have to put it online, encrypt it.

I use a cloud service to store my password manager database. It also means I can access it from multiple devices (laptop, phone, work computer, etc).

share|improve this answer
    
do you encrypt your database or are all your passwords encrypted inside the database? –  Malachi Aug 13 at 13:27
1  
Sorry about the delayed reply. The database file itself is encrypted. –  K Vaughan Sep 16 at 19:42
    
thank you for the reply. I was just curious. –  Malachi Sep 16 at 19:48

Google Drive, like most cloud hosting companies (Dropbox, etc.), have complete access to the plain data. This means that their employees (or law enforcement agents) can access it on a whim.

A more secure solution would be a cloud hosting service that encrypts the data locally (on the user machine), and transfers/stores only bits of encrypted data. Such solutions include SpiderOak and Tarsnap.

share|improve this answer

We learned recently that Google actively searches gmail messages for images with hashes matching those of known child pornography images.

I do not say whether this be good or bad, but I do say: nose, camel, tent. That being the case, one must conclude that nothing you trust to another, whether it's Google, or Apple, or Microsoft, or whomever, is safe from routine inspection. This is not a case of search warrants or court orders; this is a case where a private company has decided to conduct routine searches of the data stored on their servers. So, as others have already written, if you have to store information "in the cloud," it must be encrypted.

People have already said that, so why am I wasting electrons? It is to add that the only safe encryption is strong encryption for which you have generated the key yourself. Any encryption scheme in which someone else generates the key is useless!

share|improve this answer

When it comes to password security, I heard this tip from a security-minded colleague. When you need to change your password, get a new random password (using a strong password generator, for instance), write the password on a piece of paper, carry the paper around with you until you have memorized the password, then destroy the paper. Or preferably develop the ability to remember the new password immediately so you don't have to make a copy.

It may seem counter-intuitive to write your password on paper, but if you are going to keep a written copy somewhere, does it make sense to put it online where it could potentially be accessed by anyone with an Internet connection and the ability to overcome whatever security you have around it (note the recent history of very large password database hacks in the news), or does it make more sense to keep a copy on your person?

An additional note: use two-factor authentication wherever available.

share|improve this answer
1  
Better to have the password in two parts, a random part that is written down, and then a short word you add at the start that is not written down. The risk of using the same "short word" for all accounts is not great if the random part is different. –  Ian Ringrose Aug 14 at 12:06
    
@Ian +1 for adding the unwritten component. –  Robert Munn Aug 14 at 15:46

Assuming you use gmail as well.

Any account that can be reset with a new password sent to your email address is never more secure then you email system.

Google Drive is most likely secured with the same password as your email.

Therefore it is safe to store passwords of accounts that can be reset by email, in my case this is most account apart from banks etc.

share|improve this answer

protected by D.W. Aug 13 at 18:15

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.