3

I have a password-protected excel file that stores other personal passwords.

Obviously there have been a number of ways to crack the password.

community.spiceworks.com

Where do you guys store important passwords? For example, if you are managing company IT, you need to remember all sorts of passwords. I keep it in password-protected file on a server.

If I put my password-protected excel onto my usb or cloud, say that they are hacked and attackers obtain the excel file. He or she should be able to easily crack the password? then what would be considered the most secure way to keep the password file?

  • 2
    Product recommendations are off-topic, but there is a class of software known as a "password manager", which are designed for securing such data. – Alexander O'Mara Jun 24 '16 at 1:15
  • "Where do you guys store important passwords?" In a company? Scattered around in plain text files on a file server. – techraf Jun 24 '16 at 1:21
  • 1
    And many passwords do not really need to be stored anywhere. They're usually a company acronym + office phone number. – techraf Jun 24 '16 at 1:45
  • 1
    techraf, how do you remember all sort of passwords? isnt that less secure if you store password in plain text files a file server. I am not sure your statement is intended to answer my question – PaddyKim Jul 20 '16 at 2:27
4

What version of Excel are you using? Since Office 2007, the encryption used in MS Excel is 128 bit AES with at least a 50,000 interation SHA-1 hash. If you use the built-in encryption with a sufficiently hard password you should not have to worry about offline attacks. How to define "sufficiently hard" will probably change slightly every few years, but if you're really paranoid go with 15 or even 20 characters and then you can sleep well at night.

As for what I do, I used to use a MS Word doc with encryption as described. Now I use a password manager instead. The main difference is the manager uses AES 256 instead of 128, SHA-256 instead of SHA-1 for the hash, and a configurable number of iterations which I set to 5M. I'm still confident that the MS Word doc was extremely secure. The main reason I switched is I like the user interface of the manager better than that of a word document which isn't designed for security once the document is opened.

0

Use a key derivation function (e.g. PBKDF2) to create an encryption key for a cipher (e.g. AES) used to encrypt your password file. It provides protection against brute force attacks (admittedly PBKDF2 isn't the best KDF, but it's widely available).

BUT beware of things like the data finding it's way into the page file or in a temp file somewhere.

0

Relying all your security in a single file is dangerous. The file can be easily decrypted even if you use strong passwords. The reason is because the amount of attacks that can be done per second is incredibly high (more if you consider that a copy of the file can be attacked by multiple computers at the same time).

As Alexander pointed out, there is specialized software (password managers) that already help you in that task.

I strongly recommend to put the whole thing in an encrypted place (directory, drive, etc.), so whoever wants to get your information has to go through 2 layers.

(Note: I removed the explanation of the way I do it, as I don't want to suggest you to run your own home-made method. If you want to learn how to build your own password manager, that should be in another question). Thanks guys for all the discussion.

  • 3
    As I understand it, your secure_box is essentially a home-brew password manager. As far as I know, bcrypt is a one-way hash function, not an encryption cipher. How exactly does your tool retrieve and display the password so they can go type it in somewhere? Also, your premise is that a password protected file can be brute-forced, but isn't your solution also fundamentally a password protected file also? I'm not trying to be a jerk, just trying to understand your answer. – Mike Ounsworth Jun 24 '16 at 3:10
  • 1
    @Mike: Thanks to point out what I was missing. That made me realize that it was not as secure as I thought it was...hehe I will try to improve my code. – lepe Jun 24 '16 at 3:34
  • 1
    Suggesting a home grown solution is a terrible idea – Neil Smithline Jun 24 '16 at 3:35
  • 1
    ah I see. Brute-forcing your password (through bcrypt) is still faster than brute-forcing an AES key, so I think you're safe there. @Neil is right though: it's fun to post homebrew solutions and try to poke holes in them. I love doing that! But be careful about suggesting to the OP that this is something they should do. Especially when commercial solutions exist. – Mike Ounsworth Jun 24 '16 at 3:40
  • 1
    @Neil: Sorry that was not my intention. The OP asked "Where do you guys store important passwords", so that is how I do it... I wanted to share my own way (which I know is not perfect). – lepe Jun 24 '16 at 3:40
0

Another situation if you store your encrypted password file in the cloud is in the rare situation where your cloud provider gets shut down, like https://en.wikipedia.org/wiki/Megaupload did for copyright infringement; some legitimate companies had data on that site in addition to all the illegal movies, etc.

0

You can use a knife, screwdriver, HDD or cellphone to put a nail in place, but it's better to use a hammer. And to store passwords, use a password manager.

A password manager's only mission is to securely store passwords. They don't edit texts, don't calculate anything, don't show movies. They only store passwords, every function have security in mind, and every data stored is made sure to be secure. Even if there are bugs on them, they are safer than the alternatives, as their codebase are way smaller than any word processor or spreadsheet.

Could a hacker beat the password of your encrypted Excel files? Probably, probably not. But even if your passwords are safe inside a xls file, the correct place for them is inside a password manager with a strong master password protecting its database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.