0

I need to store multiple PDF files with sensitive information in OneDrive (consumer, not business version). However I am worried about the security risks in doing so.

I could secure the PDFs with a strong password with AES256, but given the scenario that OneDrive gets compromised and my documents are leaked, it would only be a matter of time before someone can eventually crack the PDF passwords and read the contents of the PDF files. If a hacker is already in possession of the files, there is no way I can stop him from cracking the PDF password.

So if OneDrive gets compromised, how can I make sure that the PDF files cannot be read by an unauthorized person?

Improve this question

2 Answers 2

Reset to default
2

No need to worry.

If you secure the PDF with a strong AES256 password, lets say a passphrase with numbers, special characters, and capital letters, than it wouldn't be a matter of time, it wood be a matter of billion of years for someone to bruteforce your password.

Here you can find information about cracking AES.

Improve this answer
8
  • That is what I thought, until I read this: dailymail.co.uk/sciencetech/article-2331984/…
    – Arete
    Oct 24, 2016 at 12:03
  • Yes, but those guys found a list of hashed passwords online, you don't have the intention to share your password online right?
    – Vini7
    Oct 24, 2016 at 12:10
  • 2
    @Arete Don't trust anything from The Daily Mail, especially in relation to security. They're an alarmist tabloid newspaper known for making up stuff and having awful ethical standards.
    – Polynomial
    Oct 24, 2016 at 12:52
  • @Arete: as Polynomial said, you should just ignore dailymail's butchering of ArsTechnica's article. What's missing from the dailymail article is that the passwords being cracked here are using the weakest possible password implementation. The same hacker that does this acknowledged that when he does audits for companies with good password practices, he could go for days without a single result. If you choose a strong password, and the encryption program uses password hashing/key derivation function with sufficient iterations, password cracking wouldn't go that easy.
    – Lie Ryan
    Oct 24, 2016 at 13:31
  • 1
    Thanks for the info. I am using 50+ length mixalpha-numeric passords so I guess I am safe :)
    – Arete
    Oct 24, 2016 at 14:11
2

If bruteforce or dictionary attack is your concern, you can defend against this by ensuring that the key derivation is suitably computationally intensive to make it infeasible for an attacker to crack the password, while leaving it reasonably convenient for you to decrypt them.

For example, KeePass allows you to store files in password vaults. It's primarily a password manager, but the vault file format is also suitable for files. When creating the vault you can specify the number of rounds for key derivation.

KeePass round count

Clicking the "1 second delay" button gives you a round count that will take 1 second to compute on your current machine; multiply this number by however many seconds you want it to take. If you pick a round count that takes ten seconds to compute on your system, even attacker with ten thousand times your computational resources could only try a thousand passwords per second, which isn't really a lot if your password is suitably complex and non-dictionary.

If you're looking for a more traditional option, consider using 7-zip, as it performs key derivation using using 219 iterations of SHA256 (source) by default.

Improve this answer
4
  • Thanks for making me aware of key derivation. You wrote "for example, KeePass allows you to store files in password vaults" How does this work? As far as I know it is not possible to store PDF files inside a keepass vault. Or is it? I know it is possible to attach files to an entry, but this is very unpractical when using OneDrive.
    – Arete
    Oct 24, 2016 at 11:34
  • @Arete Yes, the idea is to attach them as entries. But as I said, 7-zip is an alternative option if you'd prefer, since 2^19 rounds is sufficient to make brute-forcing extremely difficult.
    – Polynomial
    Oct 24, 2016 at 12:52
  • @Arete: it's possible to attach an arbitrary file into a KeePass database. The main problem with KeePass (and 7zip) is that to use the PDF file, you need to decrypt the file out to your filesystem first, and then attach it again later after modifying the file, which can be quite inconvenient. If you want to be able to use the file without the extract/attach every time, you might want something that have transparent encryption like VeraCrypt/TrueCrypt.
    – Lie Ryan
    Oct 24, 2016 at 12:58
  • @LieRyan Downside: VC/TC aren't any use in the context of OneDrive. I've tried running containers from those kinds of "cloud" drives and the end result is a corrupted container within a few days of use.
    – Polynomial
    Oct 24, 2016 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .