How secure is a password protected file?

Question

I have a password-protected excel file that stores other personal passwords.

Obviously there have been a number of ways to crack the password.

community.spiceworks.com

Where do you guys store important passwords? For example, if you are managing company IT, you need to remember all sorts of passwords. I keep it in password-protected file on a server.

If I put my password-protected excel onto my usb or cloud, say that they are hacked and attackers obtain the excel file. He or she should be able to easily crack the password? then what would be considered the most secure way to keep the password file?

Answer 1

What version of Excel are you using? Since Office 2007, the encryption used in MS Excel is 128 bit AES with at least a 50,000 interation SHA-1 hash. If you use the built-in encryption with a sufficiently hard password you should not have to worry about offline attacks. How to define "sufficiently hard" will probably change slightly every few years, but if you're really paranoid go with 15 or even 20 characters and then you can sleep well at night.

As for what I do, I used to use a MS Word doc with encryption as described. Now I use a password manager instead. The main difference is the manager uses AES 256 instead of 128, SHA-256 instead of SHA-1 for the hash, and a configurable number of iterations which I set to 5M. I'm still confident that the MS Word doc was extremely secure. The main reason I switched is I like the user interface of the manager better than that of a word document which isn't designed for security once the document is opened.

Answer 2

Use a key derivation function (e.g. PBKDF2) to create an encryption key for a cipher (e.g. AES) used to encrypt your password file. It provides protection against brute force attacks (admittedly PBKDF2 isn't the best KDF, but it's widely available).

BUT beware of things like the data finding it's way into the page file or in a temp file somewhere.

Answer 3

Relying all your security in a single file is dangerous. The file can be easily decrypted even if you use strong passwords. The reason is because the amount of attacks that can be done per second is incredibly high (more if you consider that a copy of the file can be attacked by multiple computers at the same time).

As Alexander pointed out, there is specialized software (password managers) that already help you in that task.

I strongly recommend to put the whole thing in an encrypted place (directory, drive, etc.), so whoever wants to get your information has to go through 2 layers.

(Note: I removed the explanation of the way I do it, as I don't want to suggest you to run your own home-made method. If you want to learn how to build your own password manager, that should be in another question). Thanks guys for all the discussion.

Answer 4

Another situation if you store your encrypted password file in the cloud is in the rare situation where your cloud provider gets shut down, like https://en.wikipedia.org/wiki/Megaupload did for copyright infringement; some legitimate companies had data on that site in addition to all the illegal movies, etc.

Answer 5

You can use a knife, screwdriver, HDD or cellphone to put a nail in place, but it's better to use a hammer. And to store passwords, use a password manager.

A password manager's only mission is to securely store passwords. They don't edit texts, don't calculate anything, don't show movies. They only store passwords, every function have security in mind, and every data stored is made sure to be secure. Even if there are bugs on them, they are safer than the alternatives, as their codebase are way smaller than any word processor or spreadsheet.

Could a hacker beat the password of your encrypted Excel files? Probably, probably not. But even if your passwords are safe inside a xls file, the correct place for them is inside a password manager with a strong master password protecting its database.