1

This question already has an answer here:

My KeePassX file has a long and strong password.

I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus in the discussions.

I'm aware of a possibility that storage or my server can be hacked, or a staff member would copy my file to her computer and try to guess my password -- this is what my question is about too.

Finally, how safe is this if my file protected by long enough password by itself not encrypted by some other tool unrelated to KeePassX? If the worst happens -- my file gets stolen by a hacker.

I need a simple and succinct answer without any "if...then", "if not...."

marked as duplicate by schroeder Oct 6 '18 at 20:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • If the password or a simple variant (upper case/lower cased, simple substitutions eg 0 for 0) is on a list of frequently used passwords such as SecLists it is nit really secure against a targeted attack. You need to define the level of attacker, curious friend vs a nation state. – zaph Oct 6 '18 at 17:52
  • Just so you know: "over 10 characters" isn't actually all that impressive. "Over 12" stands a chance of being good, but I'd suggest 16+ for a password manager's master password. – Ben Oct 6 '18 at 18:47
  • 1
    Your exact question has been asked many times and the consensus is always "it's as safe as your master password makes it". – Ben Oct 6 '18 at 19:04
2

The point of encrypting the key store is that theoretically you should be able to publish the encrypted file to the public and have nothing to worry about.

With that said, all programs have bugs, and to counter that threat it's a good idea to store your key file in an encrypted/protected area such as Dropbox.

While there's a chance Dropbox gets hacked or an employee steals your key store and attempts to hack it, the likelihood is extremely low.

Make sure you're using best practices and you'll be fine.

  • don't reuse the password for encrypting the key store

  • the keystore pass should be difficult to guess

  • use the latest version of the KeypassX program

  • Sign up to haveibeenpwned to be notified about any breaches

  • 1. How is Dropbox more secure than any other file on the computer that contains Dropbox? 2. If data (a file, etc) is encrypted with a current cipher such as AES it is secure if the key is not available—obtainable, guessable, brute forcible. – zaph Oct 6 '18 at 17:58
  • 1. Dropbox does nothing to secure files stored on your computer. Dropbox encrypts the files that are physically stored on their server in case they get hacked. 2. Maybe. AES is a cipher, it has several lengths you can use. If you use the minimum or the passphrase used is 'cat' or something guessable then it's not secure because it can be guessed, or with a short key length (a key is NOT the passphrase) it could be compromised. This really should be a separate question. – Daisetsu Oct 6 '18 at 18:01
  • 1
    Keypass encrypts the password store by default. That master password is what's used to decrypt the keystore so you can use it. – Daisetsu Oct 6 '18 at 20:07
  • 1
    I probably said it in a strange way, sorry if this is confusing. If you use keypassx the program will encrypt your passwords. This forms a keystore. If that file is stored somewhere other than your local computer some people like to either encrypt it a second time themselves or store it in a cloud service which encrypts files again for their customers. You are safe using keypassx with no additional security concerns provided you have a good password and there is no vulnerability discovered in future. – Daisetsu Oct 6 '18 at 20:14
  • 1
    @Daisetsu 1. At even the minimum key length of 128-bits AES (Advanced Encryption Standard) witrgh a random key can not be brute forced. The entire issue is a good key and keeping the key secure. 2. If a password is used it needs to be used with a key derivation method such as PBKDF2, Argon2i or similar with a CPU utilization of around 100ms. 3. To be really secure keep the password or key on paper in a secure (not fire-proof) safe. – zaph Oct 6 '18 at 21:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.