I have a list of login credentials (usernames and passwords) that I wanna keep safe. I'm planning to keep it in an encrypted Veracrypt virtual drive with AES, SHA-512, and an 8-character password. Is this safe?
4 Answers
"Safe" is relative. In general Veracrypt has a good reputation and supports strong crypto.
Assuming reasonable use, your weakest link is your stated 8-character password.
It may be safe enough depending upon the password and the expected threat, but why limit yourself to an 8-character password?
Veracrypt supports "pass phrases" up to 64 characters. You can make an easy to remember multiword sentence that is potentially much stronger than 8 characters.
*Granted it's always possible to make poor passwords and phrases.*
Additionally, Veracrypt supports a user custom PIM (Personal Iterations Multiplier). This creates an alternate iteration count from that of the default, which means brute forcing has to account for the custom PIM as well as the password/phrase. Of course this also means you have to remember this custom PIM as well.
If for whatever reason you feel you need to use only an 8-character password, I'd suggest also using a custom PIM.
answered Jul 15, 2019 at 20:42
8 character is not strong enough to make your Veracrypt volume secure even if it includes symbols. See this answer which is five years, or this article
On a supercomputer or botnet, this will take 4 hours.
You should use at least 12 even beyond for 16 characters or better and the password must include small and capitals letters, numerals, punctuations, and symbols.
As a suggestion, you should use password managers that designed for this kind of problems.
-
2Keep in mind that the referenced articles were testing against single hash iterations but Veracrypt uses on the order of a half million iterations (depending upon details). Jul 15, 2019 at 21:07
Storing credentials in an encrypted Veracrypt container would be a great thing, but you should consider the following:
a stronger password for the accessing the container: 16 characters should be a minimum to consider
make sure the operating system you access the container from is not compromised: if you have an infected OS stealing your container password you become compromised
This solution would be better than a known password manager because against password managers there are known vulnerabilities and exploits.
A new study by researchers at Independent Security Evaluators (ISE) concludes: Top password manager products have fundamental flaws that expose the data they are designed to protect, rendering them no more secure than saving passwords in a text file.
"100 percent of the products that ISE analyzed failed to provide the security to safeguard a user’s passwords as advertised,” says ISE CEO Stephen Bono. “Although password managers provide some utility for storing login/passwords and limit password reuse, these applications are a vulnerable target for the mass collection of this data through malicious hacking campaigns.”
-
"rendering them no more secure than saving passwords in a text file" is completely false and is not at all what that research concluded. What they found is that after a password manager has been unlocked the passwords are available unencrypted in RAM. Veracrypt is no better in this regard. In fact it is worse. Both require malware to be running on the local computer to exploit, and both require the vault to already be unlocked. But password managers require reading the memory of an arbitrary other process and deciphering the binary data dump. Veracrypt requires only a filesystem call.– BenJul 23, 2019 at 16:58
-
In fact, the researchers themselves explicitly say, right in their introduction: "First and foremost, password managers are a good thing. All password managers we have examined add value to the security posture of secrets management" and even quote Troy Hunt as saying "Password managers don't have to be perfect, they just have to be better than not having one." You've completely misrepresented the research.– BenJul 23, 2019 at 17:02
-
No I didn't. I used to breach Pw-Mans for fun. They were the most insecure thing in existence a few years back. Maybe they improved, but you can still use a lot of targeted exploits and vulnerabilities against them without having to to a malware attack on the target system.– OvermindJul 24, 2019 at 5:07
-
How do you propose reading application memory on an arbitrary process without running code of some kind on the target system? How do you propose doing that in a way in which you could not also read the memory of a text editor which has a (veracrypt encrypted) file open with the passwords? Or just reading the file itself? Because leaking passwords from application memory is exactly the attack the research you are referring to was exploring. There may be other targeted methods that are easier, exploiting XSS in browser extensions or something, but that's not the research you're referring to.– BenJul 24, 2019 at 16:38
-
This is a long complex discussion. If a random file is being read on your system then you already are compromised. As for the PMs, they were/still are full of severe vulnerabilities that are even worse then in previous versions and practically said they protect you but they don't. For some applications locking their container is practically useless in many scenarios. So overall it's way better to know what to expect rather than thinking you are safe but actually being compromised. Therefore, PMs are lower on a security scale than a VC/TC container because of the additional 'unknowns'.– OvermindJul 25, 2019 at 6:54
When creating a password/passphrase to protect a VeraCrypt container, StandardNotes file, or a password manager vault such as Bitwarden or KeePassXC, I use a long strong random complex unique password, containing no personal information, and no dictionary words.
An 8-character password is too short and too weak. I use the password entropy estimator in KeePassXC. Rather than use a minimum password length, I use a minimum password entropy value of 100 or 128.
I also use two-factor authentication (2FA) where available. I keep backup copies of my passwords, 2FA codes, recovery codes, and PGP keys in a fireproof waterproof digital media safe, and on Proton Drive encrypted cloud storage in Switzerland.
I keep VeraCrypt files on a removable Samsung FIT+ metal body mini flash drive. I do not use cheap generic flash drives. I remove VeraCrypt flash drives when not in use.
I also considered buying a hardware-encrypted flash drive such as a Kingston IronKey Locker 50+, but decided that a software-encrypted VeraCrypt flash drive was good enough for my needs and I did not have to buy a hardware-encrypted flash drive for $50 or more.
My Intel CPUs include AES instructions for fast hardware acceleration of AES encryption.