20

In my personal life, I use KeePassX to generate/store all my passwords. I have seen some people use a password protected OneNote section.

Does the password protected OneNote section provide a comparable level of security to KeePass? Or is the password protection a farce?

  • 18
    Without knowing any specifics, I assume KeyPass is better because it is software that is written for security, while for OneNote it is just an addon. But I would say that anything that helps the ordinary user pick random high entropy passwords and stops password reuse is a good thing, even if the security is only descent and not perfect. Do not let perfect be the enemy of the good. – Anders Nov 3 '16 at 15:25
  • 8
    OneNote (like all Microsoft products) includes some sort of telemetry. It's probably not an issue for normal usage but for passwords it can still be catastrophic. – André Borie Nov 4 '16 at 10:35
44

As far as storage is concerned, I think that any correctly encrypted file will have same level of security. The problem is that passwords are meant to be used, and then dedicated password vaults have more features:

  • ability to simulate key presses to avoid storing the password in the clipboard - and additionaly allows to use them on poorly designed web site that disallow to paste in the password field
  • even if the clipboard is used, it is cleaned after a short time to prevent the password to be inadvertantly pasted in a wrong place
  • some password managers include a password generator (keypass does) able to generate random passwords with high entropy - resistant to dictionary attacks

For all those reasons, I think that a good password manager is better than a simple encryted file, even if the crypto engines are equivalent.

  • 5
    "passwords are meant to be used" This. Until OneNote has Control+Alt+A that autotypes passwords based on program/website/etc? No competition... Dropbox + Keepass (or similar setups) is easily the win. – WernerCD Nov 3 '16 at 18:33
  • Some other features of Lastpass (not sure if KeePass has them also): *Online storage of (encrypted) passwords *Phishing protection by only filling out passwords for the correct domain *Automatic update of passwords when changing passwords *Two-factor authentication *Phone-app support – BlueRaja - Danny Pflughoeft Nov 3 '16 at 22:28
  • 1
    @BlueRaja-DannyPflughoeft keepass just stores it in an encrypted file, however it is relatively easy to put that encrypted file on a dropbox share for online storage.Most of the rest depends on how you configure it, the key can be generated from data unique to a specific windows domain user account, a random key file on a usb stick and your password you enter there and then if you wanted to go that far. Or you could just use a password. – ewanm89 Nov 4 '16 at 0:53
  • 3
    Leaving a password in the clipboard is a security problem. Having to retype by hand password in web application that prevent pasting causes normal users to choose not too complex passwords. The storage has same security level, but the usage has not. – Serge Ballesta Nov 4 '16 at 12:33
  • 5
    Paranoid me thinks that KeePass not having an online service is an advantage. I know my file can't be read by the online backup service I use (OneDrive) instead of just having to believe the claims of LastPass/1Password. – Robert Fraser Nov 4 '16 at 17:26
17

A brief look out there says that it uses AES, which is robust and the exploit tools I see look like they are doing dictionary and brute force attacks, rather than attacking something systematically broken.

However, KeePass/LastPass/similar tools are specifically designed to deal with the situation. They support multi-factor/2-factor authentication, which is a bonus. I'd still recommend these tools over OneNote password protection just because of nice integrations and ease of use, but I don't see a security issue there.

  • 7
    Good answer! I also found that at least the 2016 Mac version uses AES-128. But what key stretching does it use? That might be an important difference. – Anders Nov 3 '16 at 14:21
  • 4
    "key stretching" That's the big one. The key derivation function ideally should take 50-500ms (depending on user's hardware) to convert the password into a key, so to be brute-force resistant. However, there's no guarantee that they took this particular detail seriously. – Bryan Field Nov 3 '16 at 14:24
  • 3
    AFAIK LastPass doesn't encrypt the whole file, just the passwords, so it leaks information about which site you registered an account and usernames. (At least it used to do this time ago). – Bakuriu Nov 3 '16 at 16:25
  • 2
    "it uses AES" - what is it? KeePass or OneNote? – Thomas Weller Nov 4 '16 at 12:30
  • 1
    @Anders KeePass2 uses a custom iterated KDF based on AES with a relatively high iteration count (AFAIR the default is 1 second on the hardware you create the password database on). I'd judge it as stronger than PBKDF2-HMAC-SHA-2 with the same computation time (since it takes advantage of the AES-NI instructions) but weaker than scrypt with high memory use. – CodesInChaos Nov 4 '16 at 20:43
9

Apart from the usability concerns mentioned by @Serge Ballesta in his answer, the following security problems arise:

  • KeePass has a well documented security. They document the Key Derivation Function they use and the encryption technology used
  • KeePass is Open Source software, which means that you can verify that there is no backdoor in the software
  • A KeePass database stays on your local drive, unless you put it actively onto some cloud storage. Automatic synchronisation might not be desirable for very sensitive data, like passwords.
  • 2
    "KeePass is Open Source software, which means that you can verify that there is no backdoor in the software" - citation needed. Apart from the 'can't prove a negative' thing, by the rule that "you shouldn't trust yourself to implement your own crypto", surely "you shouldn't trust yourself to verify existing crypto"? The properties that make it hard to write correctly, implies you need similar skills to verify that it is correct, doesn't it? – TessellatingHeckler Nov 4 '16 at 0:55
  • 5
    @TessellatingHeckler: Being a bit more generous, one could suppose that the "you" is the general you in that statement. In other words, someone can audit the software but that doesn't necessarily have to be you, specifically. – Dietrich Epp Nov 4 '16 at 3:25
  • 2
    @DietrichEpp Email two people about a task and see how often both will say "I thought {other person} would do it". I, too, like to assume that someone else is doing the complex, high skill, low reward, time consuming, thankless task, and it's fine. But the way that "someone could hypothetically check for problems" is used as if it carried the weight of "someone specific _has_ checked for problems and it's fine", is a bit weird to me. "Critics liked this book" is a convincing selling point. "Someone, somewhere, could hypothetically read this book" should not be. – TessellatingHeckler Nov 4 '16 at 3:52
  • 3
    @TessellatingHeckler: You may be interested in this: ghacks.net/2016/07/22/keepass-password-manager-icode-audit Obviously, the fact that it is open source doesn't mean that it has been audited, but it does make it much easier to audit. – Dietrich Epp Nov 4 '16 at 4:39
  • 7
    Open-source means the risk if including a backdoor is much higher - it's a lot easier to get caught. So it's reasonable to assume that reduces the chance of open-source software having backdoors, even if you don't have the skills to verify it. – Tgr Nov 4 '16 at 5:19
2

A password manager and a simple encrypted database/textfile/whatever is roughly equivalent for threats which are most relevant to the average user (assuming the encryption was done decently, e.g. using a sufficiently slow method): attacks based on password reuse (ie. someone sets up a honeypot website or breaks a weakly guarded site and tests the collected usernames+passwords against gmail) and low password enthropy (ie. the password can be guessed by generating a huge list of password-like strings and trying every one of them).

The big difference is against threats where your computer is partially compromised: for example, someone installs a keylogger (good password managers can auto-type using a mix of copy-paste actions and simulated keypresses which makes it hard to log), or they spray liquid nitrogen on your computer and rip out the memory chips while you are on the toilet (good password managers avoid keeping unencrypted copies of the passwords in memory).

All in all, if there is no strong reason against it, you should use a proper password manager such as KeePass (or OnePass or LastPass). If you find some other random password generation + encrypted storage method fits your workflow better / is easier to explain to your grandma, use that and don't worry about it too much. Stealing your password from one site and reusing it at another has a fairly high chance of happening, while getting infected with a keylogger is much less likely if you use an antivirus and common sense (and if you do get infected, passwords won't be your biggest problem - it will be credit cards or identity theft).

0

I would suggest creating your own password generator, i.e. if u know how to create a simple Access database, I have done it, and I can choose the number of each type of characters or numbers or extended chars that it would take, then jumble {rearrange} them up, maybe more than once if u like, and then save it in your database for each site u want to create. However, u have to secure this database so that no one can find it on your HD or maybe store it in a flash drive. Regards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.