88

First of all, that multi-encryption scheme is ridiculous. The algorithm used by 7-Zip is AES-256 which is considered secure. But if someone would find a flaw in it which would make it breakable, then they would likely be able to break all your encryption layers with equal effort. So either you trust the encryption algorithm used by 7-Zip, then one ...


80

A threat to beware of is updates to google drive/google docs. For example they add a feature to auto-cache frequently-used files and all of a sudden it's all on the phone in plaintext. In fact it might already be there. Or the user installs the google drive app with default options for an unrelated reason. The big web-app firms are concerned with ...


56

You can increase the resiliency of your KeePass database to brute force by increasing the number of PBKDF2 iterations when deriving the database encryption key from your password. You can do this in KeePass under File > Database settings > Security. Personally, I use around 5,000,000 rounds (1 s delay). Remember that mobile devices are slower.


52

MD5 and SHA256 were both designed to be as fast as possible. Their purpose was to compute a hash for relatively big data volumes, e.g. for files. That's why they are very fast, which makes brute-forcing easier. A single GPU can generate ~10^10 SHA256 hashes per second. It is ~10^15 per day. Computing of MD5 is much faster, on some GPUs ~5 times faster. So ...


51

When thinking about security, you must be able to say: what threat you want to address what attacker you want to be protected from and then review the possible weaknesses. A restricted access file on a well configured Google drive is correctly protected from all attacks from the guy next door. As you say that the Google account is 2 ways secured (what do ...


47

There are a couple problems with this approach. First of all, you're using two plain cryptographic hash functions to hash your data. By themselves, cryptographic hash functions are designed to be fast. That means that it's extremely easy for an attacker to try to brute-force your password. The only time it's safe to use a plain cryptographic hash function ...


43

I'm not sure about Google Drive, but Dropbox provides a way to recover previous file versions, a feature that wouldn't be impacted by the ransomware, since it relies on a file copies on the Dropbox servers. So it'd certainly be a way of protecting your data. However, recovering everything over your internet connection is a relatively slow process. ...


38

This is over engineering on a scale I've never seen. This is a BAD THING ™ because it increases the complexity of your solution without adding any security benefit. The encryption mechanism is either safe, or it is not. You will not be more protected by encrypting multiple times. If the encryption is secure, it's useless to add additional layers of ...


35

It is hard to quantify exactly, but if you have the DB on a mobile device then I wouldn't say this is particularly any less secure. KeePass encrypts the DB because the file remaining secure isn't expected to be a guarantee. It's certainly preferable that the DB file not get in the wild, but if your security depends on the encrypted file remaining ...


26

First off, breathe. Encryption efforts often fails if you forget to breathe. Something about going unconscious causes us to have a hard time encrypting things! Second, it sounds like you are in need of a threat model. A threat model describes what sort of adversaries you are worried about facing. Without a threat model, all security is security theater ...


22

I use the KeePass-Dropbox combination. The password database is encrypted using a key derived from a strong master password. Even if somebody acquires your encrypted password database through your cloud account, a strong enough master password renders brute-force attacks infeasible. Simply put: Use a strong master password and stop worrying about this.


22

The document is on his personal Google drive protected by Google, as for the external attacks. So the location is more secure than e.g. his PC. The access to document needs google login, which is 2-way secured. That is fine if you trust Google, including the many Google employees with admin privileges, you believe Google can't be hacked, AND the ...


21

Simple, cheap and relatively scalable solution (Although I'm aware it has nothing with online storage to do) I have two USB drives that I rotate regularly (you can add a reminder in your calendar if you're afraid to do so). You can use one of the many synchronization tools to choose which folders should be copied, I use Allway Sync. One of the drive is ...


19

There are all excellent answers. I will try to address immediate questions. How unsafe would be to publish the hash of my passwords? Very unsafe. Irrespective of the algo used, please never share the passwords or the hash of it on open web. Why: This is a bad practice. A bad habit. You are encouraging yourself and others around you to lower your guard. ...


15

At the time of writing, Dropbox would be a good way to mitigate ransomware attacks because a 30 day version history of file changes is kept on their servers (even on the free tier). This, depending on the volume of data, requires a fast internet connection for both upload and download for it to be effective. However, (big caveat) it wouldn't take much for ...


15

What would you recommend as backup strategy to avoid Ransomware? Read Only Storage The simplest solution covers 90% of the average person's data preservation needs: store your old data in a read-only format. How much of your data is old tax information, resources from past schools/jobs, photos from vacations, or any other type of information that isn't ...


14

It's kind of scary that only one answer here mentions the verification of the backups so I felt the urge to add this answer: Whatever you chose as a backup strategy: Your backups are worth absolutely nothing if you don't have a working and well tested verification mechanism to check the integrity of the files. It's just a matter of time until ransomware ...


14

this would mean, obviously, re-uploading the single volume every time even the smallest file in it changes; It is clear that this rules out, for different reasons, VeraCrypt or EFS. That's not true. VeraCrypt does not re-encrypt the whole encrypted volume on each change of the files inside and Dropbox does not upload the whole volume if only a small part of ...


11

This isn't as bad a practice as you would think. I'm gonna tackle this in a real world sense and leave out some of the more technical things. First, when I measure security I usually try to go "Better or Worse" like when your at the eye doctor. Trying to be totally secure is a joke, while at the same time you shouldn't ignore security. So his method ...


10

Can this be for real? You have already done the math: $200 would buy 4TB of storage space, and half that sum again will connect it to the Internet with an (almost) unlimited bandwidth for one month. Supposing twenty months' life expectancy for the hard disk for ease, we get around 30 USD per month per terabyte with a DIY scheme. Since your PC is unreliable,...


9

The cloud is inherently untrustworthy, and files kept on it should be considered vulnerable, so you need strong encryption to protect you. KeePass offers that. However, you then need to be able to trust every client you enter your password into. If you read them on an iPhone, do you trust the platform? Do you shield your password from the cameras on the ...


9

Can you suggest an alternative as easy as typing a URL everytime he needs to recall a password? You could greatly increase the security of this by adding one slight tweak: Instead of using a Google Sheet, store the passwords in a document file that can be opened by all of his devices, encrypt that document with strong encryption using a different strong ...


8

Even if your KP database were to be compromised from Dropbox, using both a strong password, and additionally a keyfile not stored in Dropbox should give you security beyond any known means of electronic attack (as long as your devices aren't already compromised). The keyfile should be stored in a separate secure location, such as a USB drive which you can ...


8

No. Consumer grade cloud backup is not an effective solution. In fact no single solution will protect your data, you must mix it up a bit. To give you a good answer I would have to know about your habits, usage patterns, and a lot of other details, but here is my best guess based on an average home/small business owner I'm usually working with. So, to ...


8

If your local files get encrypted and synced they will also be encrypted in your online folders. Luckily Dropbox supports file versioning (https://www.dropbox.com/help/security/recover-older-versions) so if you happened to have your files in Dropbox get encrypted you can restore them easily.


7

Back in the day when airbags were an expensive option on expensive cars, I used to ride with a colleague who had a BMW-635 with an airbag. He believed he didn't need to wear his seatbelt because the airbag would save him. Nobody believes this any more. Both safety mechanisms are necessary, have complementary purposes Passwords used to be stored in plain text....


6

I use a stack of external USB-3 hard drives, "A", "B", "C", etc that I rotate in sequence, and run an automatic nightly backup. (my computer runs 24/7 so at night it runs tasks like full backups, deep malware scans, and occasional defrags) In other words, the drive that gets written-to tonight is the oldest one in the sequence. I keep 3 of them offsite in ...


6

Keep it simple. While cloud-sync solutions may provide protection against ransomware through file versioning, choosing individual solution requires research(1) (2) and I think it's a task not worth the hassle. Depending on a cloud service their client-functionality is different and these companies create and support their solutions mainly as a ...


5

I would suggest a solution that involves the following: KeePass Database file stored on local computer with Full Disk encryption (e.g. Veracrypt) KeePass Key File stored on an external USB disk Cloud Storage 1 (e.g. Dropbox) to hold the Database file Cloud Storage 2 (e.g. Google Drive) to hold a backup of the Key File Enable 2FA on both Cloud Storage ...


5

While a strong enough cipher should be able to resist brute force attack, consider that by storing your password database in the cloud you give the potential attacker much more information than he could get from e.g. a lost phone with the same database. Every time you modify a password, the attacker gets a new database, which he can use together with older ...


Only top voted, non community-wiki answers of a minimum length are eligible