I have a small Truecrypt volume that contains just my password data (using Bruce Schneier's Password Safe application).

I'd like an offsite, secure, backup of that Truecrypt volume. Currently, I am using mainly Spideroak, but this question would apply to any such "cloud" storage services.

Backing the volume up to the cloud means exposing it to my ISP, god knows how many other downstream servers, the storage supplier, and every eavesdropper in town. Plus I may be backing it up weekly, so there'd be a series of files available for anyone who wanted to do differential analysis.

Just how safe are my passwords when out of my hands and on all those other machines?

I am not paranoid enough to assume I am being specifically targeted (if I were, the men in black would have plenty of other ways to get to my computers), but leaks and opportunistic attacks do occur(if they didn't, I could go with plaintext files).

  • 1) For a limited definition of "safe", possibly; 2) Depends on how you store them; 3) Depends on the cloud and how they are stored; 4) Back up passwords to your brain... remember they should not be written down! – user1801810 Apr 6 '14 at 12:14

Doing this makes your data marginally less safe, since "the cloud" is just a fancy name for "someone else's computer".

However, you already have implemented a good control against offline attacks in Truecrypt. And, you've gone with SpiderOak, which is one of the safest cloud providers. So the risk increase is very small.

At the same time, you have also made them considerably more safe, because you are doing off-site backups.

All things being equal, then, you have decreased risk overall.


What exactly counts as "safe" is a matter of opinion. If you are using a decent passphrase on your Password Safe file, then the risks are low. It is effectively impossible to decrypt an encrypted file without the passphrase, so it wouldn't greatly concern me that a third party has my encrypted file.

You are right that someone could do differential analysis. For example, they can see whether you have changed any passwords in a particular week. But that's about all they could see. If that troubles you, there are defences against that, such as introducing random changes into every backup.

The biggest practical risk is that you will have malware on your computer. In that case it can get the encrypted file and your password, regardless of whatever backups you use.


Your password data is exactly as safe as the encryption of your TrueCrypt volume and the quality of the TrueCrypt volume password. For example, if you have used AES and a high entropy password to encrypt your volume, its very very very safe.

If you want to feel even more safe, create a random keyfile from Tools > Keyfile Generator menu when generating the TrueCrypt volume and keep the keyfile with you. This should be enough for you even in the "paranoid mode" :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.