1

My idea:

Storing my passwords in a text file kept on Dropbox and accessed through a python script to quickly retrieve the password for the site I want to access.

My motives:

I want to be platform-independent as much as possible (currently, my passwords are stored in Safari's integrated password manager). Also I don't want to use any third party services, free or otherwise, just to store my passwords. I try to be as minimalist as possible even in my online life.

My reasoning:

Firstly, all the passwords for my core services (gmail, apple id, bank, dropbox) are long, random, and only stored offline in my brain + I use two-factor authentication on all of them. So it's not like I am devising a system that needs to keep my most prized assets. The text file would only include passwords for less important websites and services. The worst that could happen if someone were to get access to the text file is that he posts stupid questions online under my name :D …something I don't think professional hackers usually do.

Furthermore, in order to access the text file containing the passwords, you would need to get into my dropbox (which is protected by a strong password + two-factor authentication), get into my mac (which is protected by a strong password), or access my hard disk (which is encrypted through FileVault).

Also, if someone breaks into my mac they are gonna have access to the passwords kept in safari anyway. Soooo… what am I missing?

PS: keep in my that I don't know anything about cyber security, encryption, or anything like that. I am not looking for a technical answer that I wouldn't be able to understand. Thanks.

Improve this question
11
  • 1
    You are effectively removing one factor from two-factor authentication if the file is really going to be plain text. A much better solution would be to encrypt it, and have your Python script decrypt it. You should have a strong encryption key, obviously.
    – tripleee
    May 23, 2019 at 12:33
  • Sorry, I don't understand your point. What do you mean by removing one factor? I am removing one factor from what, exactly?
    – user208682
    May 23, 2019 at 12:35
  • 1
    If you have 2FA that's password plus (e.g.) token. If your password leaks, only the token remains.
    – tripleee
    May 23, 2019 at 12:35
  • 4
    Anyway, the idea that posting some stupid stuff in your name is the worst that could happen is a common and extremely dangerous misconception. Hackers don't typically care about using your identity directly, they want it so they can pivot to a more privileged account.
    – tripleee
    May 23, 2019 at 12:40
  • 1
    The other dangerous assumption here is that there are some places where it's safe to store stuff in plaintext. Every new password leak is more proof that there is not. Follow haveibeenpwned.com for a while if you need concrete proof. What encrypting the file buys you is that it's not automatically game over and a massive failure if somebody manages to obtain a copy.
    – tripleee
    May 23, 2019 at 12:44

1 Answer 1

Reset to default
7

The problem is simple: It's insecure.

You claimed that you did not have any technical expertise and did not want to be bothered with answers you would not understand, so I will not bother you with cryptography.

Simply put, you have no disadvantage of using a password manager, and you only put yourself at risk if you do not follow this advice.

If you are interested in the technical aspects as well, I will explain them as simple as I can.

When you store your password in a password manager, the passwords are not stored in plain text. They are encrypted with a strong key (called "Data Encryption Key", or "DEK" for short), which again is protected by your password that you remember (the "Key Encryption Key", or "KEK").

If an attacker steals the data of your password manager, that data alone is useless. It is indistinguishable from a random sequence of zeroes and ones.

In order to make use of the data, an attacker would need to do one of two things:

  1. Guess the Data Encryption Key. This is generally believed to be impossible within the lifespan of your universe. An attacker could buy all the computers there are in the world and start guessing keys, they would never find it.

  2. Guess the Key Encryption Key. The Key Encryption Key is the password you use to "unlock" your Password Manager. What it actually does is decrypt your Data Encryption Key, and this is done with a very, VERY slow function. The reason it is very slow is because it is designed to be slow, which means that an attacker could not make it go faster if he wanted to.

As a result, someone stealing your Password Manager database would still result in your passwords being safe, as long as you used a strong passphrase when setting it up.

Improve this answer
16
  • Could you tell me specifically how is having the passwords inside a text file different than having them stored inside Safari? Again, I'm no expert, but if you want to access the text file you either have to know my mac password or my dropbox password. If you know my mac password you can access passwords saved in Safari just as well. So…?
    – user208682
    May 23, 2019 at 13:15
  • When you store them in your browser, your OS keychain or a password manager, those files are encrypted. This means, they are brought into a format which is unreadable unless you know the key to decrypt them. Think of it like a piece of paper with your passwords written on it, put in a box with a padlock, and the key on your person. An attacker would have to steal the box and pick the lock, instead of just having to steal the box.
    – user163495
    May 23, 2019 at 13:17
  • But my hard disk is encrypted as well. So, if I understand correctly, the increase in risk is only because, if my Dropbox account is compromised, someone would have access directly to the file, which would not be encrypted. Is this reasoning correct?
    – user208682
    May 23, 2019 at 13:20
  • @David42 Not just that, what about malicious actors at drop box? or if drop box were to log out data? or if an exploit to gain access to drop box files themselves without gaining access to accounts was found?
    – Expired Data
    May 23, 2019 at 13:24
  • 1
    @David42 If the file is encrypted, then it's not a plain text file. What you are doing is essentially a bare-bones password manager from scratch. I highly encourage you not to do this on your own, but instead use a properly tested password manager (e.g. like Keepass).
    – user163495
    May 23, 2019 at 13:36

You must log in to answer this question.