41

In the past I have seen having a Google drive document and have FTP username/passwords there.

Is storing passwords in Google drive a good practice?

Improve this question
7
  • 2
    See security.stackexchange.com/questions/62599/… for some related issues.
    – Mark
    Aug 12, 2014 at 19:26
  • 4
    In a reasonably simplified way, I would say that the only moment one should send his credentials online is when one authenticates with them (over a safe connection being an even more satisfying scenario).
    – John WH Smith
    Aug 12, 2014 at 21:17
  • 1
    @JohnWHSmith I disagree. You should never need to send your credentials online for authentication. The only time you should have to send them credentials in a reversibly encrypted form is when creating the authentication account in the first place.
    – Aron
    Aug 13, 2014 at 3:06
  • Using a password manager while having your password database stored on Drive is a win-win-win situation: Google can't divulge your credentials even if they wanted to, you maintain the convenience of easy access, and you are also reasonably protected against downtime (typically there will be several offline copies of the password database stored among your devices).
    – Jon
    Aug 13, 2014 at 11:58
  • 2
    Sophos have a good rule for this: In a security context, read "cloud service" as "someone else's PC". So to reword, is it a good idea to keep a list of your passwords on someone else's PC?
    – Chris Murray
    Aug 13, 2014 at 15:29

8 Answers 8

Reset to default
46

Is Google Drive safe?

I wouldn't say that Google drive is not a safe place to store sensitive information. But I bet you cannot rely on it. When it comes to protecting your sensitive data/privacy, it is always good to be sure, and just trusting drive is not being "sure".

Solution:

One word, Encryption.

Encrypt your data before you store them in the Google drive. Now you don't have to depend on Google to protect your data security, it is you who should keep your mouth shut about your key ;)

Note:

Encryption is not always needed when storing normal data which falls under the general category(something like the things you share in the social networks,etc.)

But it is really a great option when it comes to storing your confidential information in drive and in my experience, I am pretty sure that passwords fall under this category.

Improve this answer
7
  • 1
    Agreed, I store all manner of sensitive information on Google drive - in encrypted documents
    – Carson63000
    Aug 12, 2014 at 12:46
  • To automate this process there is a program called duplicity, it will only record the parts of files that have changed since the last backup, and encrypts locally before transferring. For an example see shobute.com/posts/backup-to-google-drive-with-duplicity.
    – Ben
    Aug 12, 2014 at 20:40
  • Given the "amount" of data being stored on Google Drive, we would be approaching OTP encryption level (password protecting a password). Assuming OTP level encryption, then the problem is reduced to storing and protecting a password securely. Which happens to be the SAME problem we were trying to solve.
    – Aron
    Aug 13, 2014 at 3:10
  • 3
    and where do I store that key??
    – user3459110
    Aug 13, 2014 at 8:11
  • 1
    @Damon Ease of access! I agree that confidential data are worth spending time in encryption/decryption.But if the user have to decrypt every single time he needs to access anything(even things like the user's social media pictures which is already available in the internet for the whole world),then eventually he/she is gonna get sick of the process which might result in giving up the whole encryption step to make life easier.Trust me, no security method is really worth it, if it degrades the user experience. So it is recommended to use security methods only if there is a need for security.
    – Ebenezar John Paul
    Aug 14, 2014 at 12:15
21

Quick answer: NO.

If you ever decide that you will automatically log-in to google drive on your device, anyone with access to your machine has access to your passwords.

If you want to store passwords I think you might be better off using a password manager.

Check this list: http://www.pcmag.com/article2/0,2817,2407168,00.asp

Improve this answer
14

Only if you trust Google with that information. This is because in all likelihood Google has access to everything in your Google drive and can extend that access to anybody given a court order to do so.

As for if this is good practice...no, it's not.

Improve this answer
6
  • 10
    ... can extend, and can be forced to extend, ...
    – O. R. Mapper
    Aug 12, 2014 at 13:31
  • google does not have access to anyone's drive. I had to work with their support and had to explicitly share the files with google in order for them to see it.
    – code ninja
    Aug 12, 2014 at 15:37
  • 14
    @matejkramny I can see where you are coming from but in the end your data is on their servers to which they control access and which can be decrypted server side. I have no doubt that should they be ordered to, they can access your data. I think in your case it is true that the support personnel do not have direct access to your data on your drive and I support that completely, but I am fairly sure that a bit further up in the management hierarchy there are people with the authorization to access your data.
    – ilikebeets
    Aug 12, 2014 at 15:48
  • 1
    @ilikebeets Hmm good point. They're probably compliant with many secret three-letter-agencies..
    – code ninja
    Aug 12, 2014 at 15:50
  • 3
    @matejkramny: Eh? It's their drive! Of course they have access to it. Whether a frontline support tech has access to the backend servers is an entirely different thing.
    – Lightness Races in Orbit
    Aug 13, 2014 at 15:06
8

A good rule of thumb is: if you don't want to risk other people seeing it, don't put it online. This especially goes for passwords.

If you have to put it online, encrypt it.

I use a cloud service to store my password manager database. It also means I can access it from multiple devices (laptop, phone, work computer, etc).

Improve this answer
2
  • do you encrypt your database or are all your passwords encrypted inside the database?
    – Malachi
    Aug 13, 2014 at 13:27
  • 1
    Sorry about the delayed reply. The database file itself is encrypted.
    – K Vaughan
    Sep 16, 2014 at 19:42
5

Google Drive, like most cloud hosting companies (Dropbox, etc.), have complete access to the plain data. This means that their employees (or law enforcement agents) can access it on a whim.

A more secure solution would be a cloud hosting service that encrypts the data locally (on the user machine), and transfers/stores only bits of encrypted data. Such solutions include SpiderOak and Tarsnap.

Improve this answer
3

We learned recently that Google actively searches gmail messages for images with hashes matching those of known child pornography images.

I do not say whether this be good or bad, but I do say: nose, camel, tent. That being the case, one must conclude that nothing you trust to another, whether it's Google, or Apple, or Microsoft, or whomever, is safe from routine inspection. This is not a case of search warrants or court orders; this is a case where a private company has decided to conduct routine searches of the data stored on their servers. So, as others have already written, if you have to store information "in the cloud," it must be encrypted.

People have already said that, so why am I wasting electrons? It is to add that the only safe encryption is strong encryption for which you have generated the key yourself. Any encryption scheme in which someone else generates the key is useless!

Improve this answer
2

Assuming you use gmail as well.

Any account that can be reset with a new password sent to your email address is never more secure then you email system.

Google Drive is most likely secured with the same password as your email.

Therefore it is safe to store passwords of accounts that can be reset by email, in my case this is most account apart from banks etc.

Improve this answer
1
  • But in some cases, the email used to reset password does not contain the new password, but a url link to manually reset it. Is that safer than the email containing the new password itself?
    – Prem
    Jul 11, 2019 at 5:59
1

When it comes to password security, I heard this tip from a security-minded colleague. When you need to change your password, get a new random password (using a strong password generator, for instance), write the password on a piece of paper, carry the paper around with you until you have memorized the password, then destroy the paper. Or preferably develop the ability to remember the new password immediately so you don't have to make a copy.

It may seem counter-intuitive to write your password on paper, but if you are going to keep a written copy somewhere, does it make sense to put it online where it could potentially be accessed by anyone with an Internet connection and the ability to overcome whatever security you have around it (note the recent history of very large password database hacks in the news), or does it make more sense to keep a copy on your person?

An additional note: use two-factor authentication wherever available.

Improve this answer
2
  • 1
    Better to have the password in two parts, a random part that is written down, and then a short word you add at the start that is not written down. The risk of using the same "short word" for all accounts is not great if the random part is different.
    – Ian Ringrose
    Aug 14, 2014 at 12:06
  • @Ian +1 for adding the unwritten component.
    – Robert Munn
    Aug 14, 2014 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .