0

Are there any risks of using the same password to encrypt the same data stored in multiple places?

To my understanding this doesn't add anything as the strength of protection would be equal to the weakest of the passwords anyway. I can assume that it might even make the job of an attacher easier if they retrieve multiple copies of the same data encrypted with different passwords.

Clarification: while the answers I've got are definitely useful they do not focus on my main question about use of the same password for copies of the same data but rather on storing data securely. I've edited the question and removed the examples to avoid confusion.

1

strength of protection would be equal to the weakest of the passwords anyway.

Generally yes, but also depends on attacker's ability to get a hold of the encrypted data. If they cannot get a copy of the data, then you have already won. If they get a copy (eg from a cloud service), but that copy uses a key / password / passphrase they do not have, then they may try to brute-force it. In this specific case, you will hope it uses a strong key and good encryption algo. They might instead just try and steal your password, which is usually easier.

Tips:

  • Take special care in how the data is encrypted / decrypted so as not to leak the password, etc. A hardware device / offline computer helps reduce the attack surface.
  • OpenPGP keys are MUCH stronger than a password, so use that instead if possible.
  • If PGP key is not an option, consider a long set of truly random words in the form of a passphrase. These are generally much stronger and easier to remember.
  • If there is no need to have weaker password for something, then just use the same, strong system for both copies of the data.
  • I do agree with your recommendation to use PGG whether possible (and I do) but it still doesn't alleviate a need for passwords. My GPG key is still symetrically encrypted with a password and encrypted hard drive as well. While it's probably possible to replace those with physical security instead (store unencrypted private GPG key or disk encryption header in a safe) this would basically replace notion of password by a physical key or safe code coming to the same question in the end. – raindev Nov 1 '17 at 10:32
0

Is it "safe"? It depends. How strong is the password? I would say that storing multiple copies of your data weakens your protection. If it's the same password on 2 different locations, an attacker has 2 possible places to find your data, not 1. So the obscurity factor (not a good way to provide security, but nonetheless has some value) is reduced. If you use the same password, they'll need to crack it wherever. Now say you have 2 different passwords, on 2 different storage places. You're correct in that the level of protection is as good as your weakest password. Now think of this: identical data is stored in 2 places, and an attacker now doesn't need to guess 1 and only one password, they have to guess 1 of 2 passwords. That, to me, doubles the possibilities of finding your data. I'd only store my data in multiple places for availability of the data or disaster recovery - not security.

From a security perspective, a more effective way to protect it is with a 15-character password. That will take a long time to brute-force, especially if you add special characters or Alt (non-English) codes for a character, such as ä. (Alt+0228)

If you really want to secure your data, there are services that offer what is essentially RAID over multiple cloud providers. So they crack your data on Amazon - big deal. Without cracking Azure and Dropbox, they really don't have much to go on.

  • While your statement that having multiple copies of data weakens protection might be true, if data is of any importance it needs to be backed up so multiple copies are inevitable. – raindev Nov 1 '17 at 10:24
  • Not having multiple copies of important data/files is really a bad idea. This question was about security, however, and not availability. – baldPrussian Nov 1 '17 at 12:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.