I have a text file in which I store all my bank details. I compress and encrypt it with 7-Zip using the following parameters:

Compression parameters:

  • Archive format: 7z
  • Compression level: Ultra
  • Compression method: LZMA2
  • Dictionary size: 64 MB
  • Solid Block size: 4 GB
  • Number of CPU threads: 4

Encryption parameters:

  • Encryption method: AES-256
  • Encrypt file names: True

The password for the encryption is chosen such that it won't be found in any dictionary and is rather an almost random string (composed of 15-20 upper and lower case letters, numbers, and symbols). I do not store this password anywhere.
Also, the filename of the text file is kept such that no one will be able to tell that the file is related to bank details at all.

Is this secure enough, under the following scenarios?

  1. The attacker takes full control of the system, but does not know that this particular file is of any importance to him.
  2. The attacker is in possession of the file, and is actively trying to decrypt it, knowing that it has the bank details.
  • 3
    In question 1, if attacker can find the unencrypted version of the file (ie, original text file not erased from storage media), his job is pretty simple! – Nikhil_CV Sep 19 '15 at 16:17
  • 3
    Now that the internet knows about the existence of this file, I think we can rule out scenario 1 ;) – LS97 Sep 19 '15 at 20:15
  • 4
    @AnmolSinghJaggi: Yes, you do not store the unencrypted file anywhere, but 7-zip does it automatically for you (how convenient, isn't it? ;) ) in the Windows Temp directory so the file is accessible and can be opened by an external text editor software. The worse case is that very often such application will then not even take care to delete the file, relying on automatic Windows cleaning to do this at some point in the future... (Windows Temp directory, like the browser's cache directory, can be real cave of wonders for the attackers!) – WhiteWinterWolf Sep 20 '15 at 9:08
  • 1
    @WhiteWinterWolf You are correct. I noticed the temporary file when I opened the encrypted file. Also, 7-Zip does delete the temporary file after I am done accessing the encrypted file. – Anmol Singh Jaggi Sep 20 '15 at 11:02
  • 2
    @AnmolSinghJaggi: Yes (they try to do things properly :) ), but this will be true only if you close the text editor before 7zip. If, for some reason, 7zip is closed while the file is still opened, the file will remain here until next general temp files cleaning. – WhiteWinterWolf Sep 20 '15 at 12:39
up vote 32 down vote accepted

7-zip (or any other similar utilities) encryption is designed to protect archived files. So, as long as the tool designers did their job well, you are safe for the second case (somebody getting his hand on the encrypted file and trying to crack it).

However, such utility are not designed to protect you against your first mentioned case (someone getting access to your account data on your machine and/or you accessing the file content regularly). Indeed, someone having taken a full (or even just minimal, no need to escalate privileges) access to your system will see you use this file and will also be able to capture your keystrokes while you type your password. Even worse: an attacker will actually will not even have to bother with this since the file will most probably be present in clear form in your Windows Temp directory.

So, for your first threat, I would definitively recommend you to use a tool designed for this usage, like KeePass which will avoid to store decrypted data in temporary files and will provide a minimum protection when typing the password.

  • Would it be better to keep the software on a portable storage device (so as to require physical access)? – Alpha3031 Sep 20 '15 at 10:24
  • 1
    @Alpha3031: I'm not sure if by "the software" you mean 7zip or KeePass. Personally, I would tend to prefer to have the executables files installed in the proper directory so the OS can prevent any unexpected modification of their files, which is not the case with external storage device. If using an external device, I would put on it either the encrypted data, or an additional keyfile needed to be associated to the password in order to decrypt the data (a functionality offered by KeyPass). – WhiteWinterWolf Sep 20 '15 at 12:43

To continue with the aggressive scenario.

It could be assumed that the original text file is deleted and with knowledge of the temp file it too can be deleted.

However there are a few tools that find deleted files and can easily recovered them unless you use a "shredding" program that fills the "blank" spaces on the drive with random bits overwriting the original information.

While your zip hiding method would be useful against the casual computer user, a serious perpetrator could utilize this software, recover the deleted information and access the sensitive file.

Even though you have misleading names on your text file the "hacker" would likely recover all the deleted files they could find and use a tool to quickly search any plain text files for key words or numbers relating to banking.

The problem with using 7z or other such software to save encrypted text file with bank detail is that when you need the data, you will have to open the file and unzip it. At that time 7z will dump an unencrypted copy of it in Windows temp directory. You (or 7z software) will need to wipe the temp directory properly every time you open the file.

This isn't the best solution for saving bank details. Use software particularly designed for this. I would suggest use Keepass instead. You won't have to deal with anything unencrypted being dumped in Windows temp directory.

protected by Community Sep 26 at 19:02

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.