86

First of all, that multi-encryption scheme is ridiculous. The algorithm used by 7-Zip is AES-256 which is considered secure. But if someone would find a flaw in it which would make it breakable, then they would likely be able to break all your encryption layers with equal effort. So either you trust the encryption algorithm used by 7-Zip, then one ...


79

A threat to beware of is updates to google drive/google docs. For example they add a feature to auto-cache frequently-used files and all of a sudden it's all on the phone in plaintext. In fact it might already be there. Or the user installs the google drive app with default options for an unrelated reason. The big web-app firms are concerned with ...


50

When thinking about security, you must be able to say: what threat you want to address what attacker you want to be protected from and then review the possible weaknesses. A restricted access file on a well configured Google drive is correctly protected from all attacks from the guy next door. As you say that the Google account is 2 ways secured (what do ...


47

You can increase the resiliency of your KeePass database to brute force by increasing the number of PBKDF2 iterations when deriving the database encryption key from your password. You can do this in KeePass under File > Database settings > Security. Personally, I use around 5,000,000 rounds (1 s delay). Remember that mobile devices are slower.


43

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox servers. So it'd certainly be a way of protecting your data. However, recovering everything over your internet connection is a relatively slow process. ...


37

This is over engineering on a scale I've never seen. This is a BAD THING ™ because it increases the complexity of your solution without adding any security benefit. The encryption mechanism is either safe, or it is not. You will not be more protected by encrypting multiple times. If the encryption is secure, it's useless to add additional layers of ...


32

It is hard to quantify exactly, but if you have the DB on a mobile device then I wouldn't say this is particularly any less secure. KeePass encrypts the DB because the file remaining secure isn't expected to be a guarantee. It's certainly preferable that the DB file not get in the wild, but if your security depends on the encrypted file remaining ...


26

First off, breathe. Encryption efforts often fails if you forget to breathe. Something about going unconscious causes us to have a hard time encrypting things! Second, it sounds like you are in need of a threat model. A threat model describes what sort of adversaries you are worried about facing. Without a threat model, all security is security theater ...


21

I use the KeePass-Dropbox combination. The password database is encrypted using a key derived from a strong master password. Even if somebody acquires your encrypted password database through your cloud account, a strong enough master password renders brute-force attacks infeasible. Simply put: Use a strong master password and stop worrying about this.


21

Simple, cheap and relatively scalable solution (Although I'm aware it has nothing with online storage to do) I have two USB drives that I rotate regularly (you can add a reminder in your calendar if you're afraid to do so). You can use one of the many synchronization tools to choose which folders should be copied, I use Allway Sync. One of the drive is ...


21

The document is on his personal Google drive protected by Google, as for the external attacks. So the location is more secure than e.g. his PC. The access to document needs google login, which is 2-way secured. That is fine if you trust Google, including the many Google employees with admin privileges, you believe Google can't be hacked, AND the ...


15

At the time of writing, Dropbox would be a good way to mitigate ransomware attacks because a 30 day version history of file changes is kept on their servers (even on the free tier). This, depending on the volume of data, requires a fast internet connection for both upload and download for it to be effective. However, (big caveat) it wouldn't take much for ...


15

What would you recommend as backup strategy to avoid Ransomware? Read Only Storage The simplest solution covers 90% of the average person's data preservation needs: store your old data in a read-only format. How much of your data is old tax information, resources from past schools/jobs, photos from vacations, or any other type of information that isn't ...


14

It's kind of scary that only one answer here mentions the verification of the backups so I felt the urge to add this answer: Whatever you chose as a backup strategy: Your backups are worth absolutely nothing if you don't have a working and well tested verification mechanism to check the integrity of the files. It's just a matter of time until ransomware ...


12

this would mean, obviously, re-uploading the single volume every time even the smallest file in it changes; It is clear that this rules out, for different reasons, VeraCrypt or EFS. That's not true. VeraCrypt does not re-encrypt the whole encrypted volume on each change of the files inside and Dropbox does not upload the whole volume if only a small ...


10

Can this be for real? You have already done the math: $200 would buy 4TB of storage space, and half that sum again will connect it to the Internet with an (almost) unlimited bandwidth for one month. Supposing twenty months' life expectancy for the hard disk for ease, we get around 30 USD per month per terabyte with a DIY scheme. Since your PC is unreliable,...


9

The cloud is inherently untrustworthy, and files kept on it should be considered vulnerable, so you need strong encryption to protect you. KeePass offers that. However, you then need to be able to trust every client you enter your password into. If you read them on an iPhone, do you trust the platform? Do you shield your password from the cameras on the ...


9

Can you suggest an alternative as easy as typing a URL everytime he needs to recall a password? You could greatly increase the security of this by adding one slight tweak: Instead of using a Google Sheet, store the passwords in a document file that can be opened by all of his devices, encrypt that document with strong encryption using a different strong ...


9

This isn't as bad a practice as you would think. I'm gonna tackle this in a real world sense and leave out some of the more technical things. First, when I measure security I usually try to go "Better or Worse" like when your at the eye doctor. Trying to be totally secure is a joke, while at the same time you shouldn't ignore security. So his method ...


9

If your local files get encrypted and synced they will also be encrypted in your online folders. Luckily Dropbox supports file versioning (https://www.dropbox.com/help/security/recover-older-versions) so if you happened to have your files in Dropbox get encrypted you can restore them easily.


8

No. Consumer grade cloud backup is not an effective solution. In fact no single solution will protect your data, you must mix it up a bit. To give you a good answer I would have to know about your habits, usage patterns, and a lot of other details, but here is my best guess based on an average home/small business owner I'm usually working with. So, to ...


6

I use a stack of external USB-3 hard drives, "A", "B", "C", etc that I rotate in sequence, and run an automatic nightly backup. (my computer runs 24/7 so at night it runs tasks like full backups, deep malware scans, and occasional defrags) In other words, the drive that gets written-to tonight is the oldest one in the sequence. I keep 3 of them offsite in ...


6

Even if your KP database were to be compromised from Dropbox, using both a strong password, and additionally a keyfile not stored in Dropbox should give you security beyond any known means of electronic attack (as long as your devices aren't already compromised). The keyfile should be stored in a separate secure location, such as a USB drive which you can ...


6

Keep it simple. While cloud-sync solutions may provide protection against ransomware through file versioning, choosing individual solution requires research(1) (2) and I think it's a task not worth the hassle. Depending on a cloud service their client-functionality is different and these companies create and support their solutions mainly as a ...


5

In a generic sense neither internal nor external hosting are inherently more or less secure on their own. Ultimately it's just a different set of trade-offs. In both situations the amount of security controls, how they are integrated, how they are managed, and response to events could theoretically be the same regardless of location. There is a small edge ...


5

"The cloud" is marketing-speak for "other people's servers", so I will use that term instead. When you move your data to other people's servers, you need to be aware that they have direct access to your data. When they are not trustworthy, they are able to steal your data. Read the privacy policy of the people you give your data to. Many people do not give ...


4

The NAS Setup is my favorite choice, for second backup you could use an offline harddisk to make a backup once a month. The NAS is nice because you can take the disks offline whenever you want OR you can do what I try to do. Switch the disks around, once a year, clean disks on the NAS (also good for speed etc). Keep the old harddisks in a good place (and ...


4

While a strong enough cipher should be able to resist brute force attack, consider that by storing your password database in the cloud you give the potential attacker much more information than he could get from e.g. a lost phone with the same database. Every time you modify a password, the attacker gets a new database, which he can use together with older ...


4

No solution involving "backup to cloud" code that runs SOLELY* on your "work" PC is safe. *updated thanks to comments Sooner or later the ransom-ware authors will start hijacking cloud-storage logins. My solution is to share the users folders so that a 2nd highly secure Linux box somewhere (local or cloud) can read the users files and back them up to ...


4

Crashplan, a paid cloud storage provider, has a dedicated article on how its online cloud storage solution can help you recover from some ransomware attacks. Their services could be a suited alternative for your use-case where you need to backup a large amount of data for long-term storage (thanks @GuntramBlohm). Excerpt: CryptoLocker and CryptoWall are ...


Only top voted, non community-wiki answers of a minimum length are eligible