4

Like a lot of people, I use a password manager (Keypass). For convenience I have this stored on Dropbox and is a part of the various backups that I do (Both local and offsite).

I am thinking of storing sensitive documents in this file (i.e. Passport, Drivers License etc) for convenience and [physical] safety but I am a little concerned that if the encryption is hacked and the file gets in the hands of bad people that they can now compromise a whole lot more than just my passwords.

Is the storage of such items on my password manager a good idea? Is there a better way of storing such items so that they are accessible, but more secure than using a password manager alone?

Improve this question
1
  • 1
    As long as you use a good password and big amount of hash rounds you should be safe. You can also use key files which you have on every client local but never sync via dropbox.
    – BlueWizard
    Commented Apr 15, 2017 at 10:19

2 Answers 2

Reset to default
3

Keepass uses state of the art encryption and is considered safe now. The same holds true for alternatives for encrypting files in a public cloud drive, like a Veracrypt container or a stacked filesystem (like gocryptfs or cryptomator).

But (there is always a "but"), if you put anything encrypted into someone else's hands, he can run an offline attack against it, which is the easiest way of attacking, since no rate limiting can be applied. He can run this attack right now (which will probably only successful if you picked a weak password), or he can run it at any point in the future (when the algorithms used have been compromised).

So, if you picked a really good password and the documents you are storing are only short term (like an Id which expires every few years) and can not be exploited after their expiration (a credit card number usually stays the same on the next card, for instance) then it is probably safe to store such thing encrypted online, otherwise not.

Generally speaking, you should always ask yourself the question. "Do I really need to put this file online? Do I really need to be able to access it from all my devices at all times?". If you do not have a good reason for doing so, let it be.

Improve this answer
-3

No, it's not a good idea.

Make a small encrypted container (like Veracrypt volume) and store them there. It's easy to use and you only need to remember one password to access that volume.

Improve this answer
5
  • 3
    There is not really a difference from a security perspective between encrypting information in a Keepass database or encrypting it in a Veracrypt container.
    – mat
    Commented Apr 14, 2017 at 8:40
  • If your password manager isn't open source, you have a problem.
    – Overmind
    Commented Apr 14, 2017 at 9:14
  • That is a problem, but is also no different for disk encryption software.
    – mat
    Commented Apr 14, 2017 at 10:26
  • 2
    Also the question specifically mentioned KeePass, which is open-source, and you mention none of those concerns in your answer anyway.
    – Ben
    Commented Apr 14, 2017 at 17:36
  • KP stores passwords, VC doesn't.
    – Overmind
    Commented Apr 18, 2017 at 5:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .