I would like to just have a single .pdf document that has all of my passwords and sensitive info included, but have it password protected so that I could store it in Dropbox and sync it to multiple computers/phones/etc. If I use the 256bit AES encryption with the latest version of acrobat, is this just as safe as password manager's technology? Is there any reason not to do this?

  • "Is there any reason not to do this?" You mean apart from the fact that a PDF editor (and, more importantly, viewer) is not designed to be used as a password manager? Who's to say some viewers don't cache PDF files into a temporary folder for history/faster viewing/whatever? You wanted this to have access to your passwords on public/semipublic computers? Boom, there go all your passwords. If it's a private computer/phone, why not use a password manager (they can sync too, you know)? Basically, it's a bad idea, even if the crypto is sound (and the crypto itself is rarely the problem). – Thomas May 14 '14 at 8:37

...is this just as safe as password manager's technology? Is there any reason not to do this?

I've done a little bit of security analysis on the keepass password manager, so I think telling you some of the things they have done to increase security will help you understand why this is a bad idea.

  1. Even after decryption, memory is still protected (in Windows using DPAPI). This means that while your password DB is "decrypted" when you enter your password, all the passwords are still encrypted using DPAPI. This prevents memory scraping attacks where other processes read through their uninitialized memory to try to find interesting information.

  2. When you copy a password from keepass in order to paste it into your browser window, for example, keepass gives you only a certain amount of time before it wipes the clipboard. This makes it harder for other applications to find passwords in the clipboard.

  3. When you enter your master password into keepass, once it has decrypted the DB, it wipes the password from memory to ensure it doesn't leak. We don't really know if PDF viewers do the same.

  4. Password managers do not store decrypted versions of your DB in temporary files, etc. We don't know if PDF viewers do that.

You can sync a password DB from password managers using Dropbox or another file syncing program. So, there really is no benefit to doing things the way you suggest.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy