2

I store my passwords in a multitude of ways, these are all sorts of passwords, not only for websites and browsers. I also have credit card numbers, addresses etc...

Now I'm using these methods:

  1. LastPass + downloaded CSV or all my passwords
  2. Plain text file in a folder on my desktop PC
  3. Spreadsheet in a folder on my desktop PC
  4. Google sheet locked spreadsheet
  5. In text expander apps on desktop (Beeftext)
  6. I also store them in Keynote (organization app on desktop)

Are any of these options safe or dangerous?

1 Answer 1

4

LastPass is the only one of those that's really suitable, as it neither stores the passwords in plain text (where anybody who steals the machine, or any malicious process, can read them and steal them) nor stores them on somebody else's computer in a readable form (LastPass uses "zero-trust" end-to-end encryption; their servers never have enough information to decrypt your vault). Note that LastPass can store arbitrary data types (and credit card numbers are an explicitly supported type) in the encrypted vault; you don't need other storage locations. Also, LastPass can be accessed through a desktop app as well as a browser.

If you don't want to use LastPass for everything, there are plenty of other password managers. Some store their vault locally rather than using any cloud-based storage, which means you don't have to worry about how good the zero-trust system is; there's no server to trust anyhow. Some have better integration with different systems (usually browsers but sometimes other apps too). Recommending specific software is out of scope for this site, but there are only a few widely recommended password managers at any given point in time.

Most operating systems (or in Linux's / BSD's case, desktop environments) have a built-in secret storage, which might be called "keychain", "wallet", "vault" or similar. This is usually (though not always) encrypted with a key derived from (or protected by another key derived from) your login password, so it's usually not a lot of protection against malicious running processes, but it's secure against a thief unless they can figure out your password. You can also protect against thieves by using full-volume encryption, such as Bitlocker (Windows), FileVault (Mac), LUKS (Linux), or VeraCrypt (cross-platform). For protecting against malicious processes on the running machine, there are two standard protections: access controls prevent code running under any other account from reading your files (unless the other process is very highly privileged), and sandboxes prevent even code running under your account from reading files they don't need. All major operating systems support both of these, though the degree to which each is used, and the way in which it works, varies between platforms and also depends on what software you install and how you use the system.


EDIT: An important consideration is that, just like other data, passwords can and should be backed up. This could be backing up to multiple independent instances of the same sort of storage (password managers, flashdrives in safes, etc.), or to multiple types of storage.

Passwords do have the complication that everywhere they are stored is another opportunity for them to be exposed. Security is only as strong as the weakest link, but it's hard to know which link is weakest for sure, so adding many links (opportunities for attack) is dangerous (this concept is called "attack surface"). As such, it's important to balance the importance of preserving data against loss, with the risk of the same data being compromised. It's also important to ensure that all storage of passwords (or any other sensitive data) meets a suitable minimum level of security.

While I said above that LastPass is the only really suitable option from your list, that's not quite true; if the CSV is stored in a physically secured location (such as on a disk / flashdrive in a locked safe), that is secure (well, as secure as the safe is). Having such an "offline backup" is a very good idea (though it will want periodic updating).


Going down your list specifically:

  • LastPass: probably safe, so long as your password is really good (which inherently means unique; a password you use anywhere else is not a good password). Adding multi-factor authentication helps. Don't leave your vault unlocked when you don't need it, since if it's unlocked and an attacker steals the machine or gets code execution as you, they can read the contents.
  • Downloaded CSV of all passwords: Safe only if stored in a physically protected location, such as on a flashdrive that is kept in a locked physical safe or a bank's safety deposit box. Unsafe otherwise, as it could be stolen or read by an untrusted process. EDIT: In general, this or something like it is a good candidate for an offline backup, stored somewhere highly secure and periodically updated.
  • Plain text file in a folder on PC: Unsafe unless that file is encrypted, and ideally also stored in a location no other account on the machine can access. Not all file encryption is equally good, and in all cases the quality of the key (or password used to derive the key) matters.
  • Spreadsheet in a folder on PC: Unsafe for exactly the same reason as above.
  • Google Sheets locked spreadsheet: Probably unsafe, depending on who you trust. Google can definitely read this, probably trivially. Depending on exactly what you mean by "locked" (AFAIK, Google doesn't offer the ability to actually encrypt sheets), anybody else that gets access to your Google account probably can too. In the event of a stolen machine, depending on whether the sheet was open in a browser tab or similar, an attacker might be able to read it if you don't use full volume encryption. Depending on your platform and browser, if you don't use full volume encryption and do leave your Google account permanently signed in, a thief might be able to hijack you Google session token and access the sheet through your account that way.
  • Beeftext: Probably unsafe. I'm not familiar with this software but I'd be very surprised if it doesn't store all its data in a format about as readable as the spreadsheet. Possibly even worse, if it also stores it on other computers ("the cloud") without end-to-end and ideally zero-trust encryption (would be very surprising if it has that).
  • Keynote on the desktop: Unsafe for the same reasons as the plain text file and spreadsheet; Keynote data is stored in files in your user profile.

Recommended options:

  • Keep using a well-trusted password manager. They're specifically designed to solve this problem. Make sure your password (and other authentication factors) are good, and it's not left unlocked.
  • Store the data in a file on your PC, but encrypt the file using good file encryption software. Windows' built-in file encryption isn't bad except that it is based on your login password and is transparent to any process running as you, which isn't ideal (although realistically if any malicious software is running with your privileges, everything sensitive on that machine is probably compromised). Don't leave the file unencrypted when not using it. This method risks exposure through things like temp files created by your editor when reading the file.
  • Store the data in a file on a flashdrive, and encrypt the flashdrive using full-volume encryption (or, if it's a drive with hardware encryption support, using that). Still needs to be a strong password/key, and not be left unlocked where it might get found by a malicious program.
  • EDIT: Store the data in a file or document, either digitally on a removable drive, or physically on a printout, and store the storage (drive, paper, etc.) in a physically secured location. A locked (and ideally fireproof) safe, or a bank's safe deposit box, or similar, are popular choices for this. While this option is not suitable as primary storage - it takes too long to access and is inconvenient to enter the passwords from - it's a good backup in case something happens to your primary storage (such as forgetting the LastPass master password or the other recommendations' data encryption password, or a company going out of business, etc.).
3
  • Insanely clear answer! My search is over, thanks! Commented Apr 22, 2022 at 13:16
  • Can we say that during a catastrophic event the lasspast's storage will not go forever?
    – kelalaka
    Commented Apr 23, 2022 at 2:47
  • 1
    @kelalaka It is absolutely possible that LastPass's storage may be lost, to catastrophe or change of business plan or simple cessation of business. Backups (in secure locations/formats) are of course a good idea, but I should have made this clearer in my post. I will edit that in.
    – CBHacking
    Commented Apr 24, 2022 at 5:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .