You're also giving the attacker information about your password-related activity. This would open doors for KPA which may be close to trivial in case you reuse passwords.
SITTING ON CLOUDS SAFE PASSWORD
by cracking a poorly protected password database from one of the sites you visit), he may be able to identify that password in your database. If he also happens to have one of your passwords (e.g. You will need a stronger cipher to resist that, compared to simple COA. a lost phone with the same database.Įvery time you modify a password, the attacker gets a new database, which he can use together with older versions in differential analysis attacks. While a strong enough cipher should be able to resist brute force attack, consider that by storing your password database in the cloud you give the potential attacker much more information than he could get from e.g. (The only reason I haven't is that I don't have a particular need to coordinate a key database in that manner.) A public cloud based solution should work as a fine second option though. Personally, I'd probably end up using my OwnCloud (which is self hosted), but I have the advantage of having my own personal web server and I realize that's not an option everyone can take advantage of. You're still in trouble if someone can compromise your cloud account first and get the file, but it requires two points of compromise instead of one. If you encrypt the file that you store online and then keep that key with you protected by a similar master password, now the online component alone is much, much harder to decrypt (likely impossible if done correctly) and if your key file gets compromised, you simply re-encrypt your online DB immediately with a new key. The master password provides pretty good security as long as you choose a difficult to brute force password (long and truly random), but it still can't compete with an actual long encryption key. If you want to secure it even further, you can add another layer of security by encrypting the file you store in cloud storage online. In this way, it may even be slightly preferable to having a local copy on a mobile device as someone may compromise the file if you take your eyes off your device even momentarily and it would be much harder to identify that breach occurred. It's certainly preferable that the DB file not get in the wild, but if your security depends on the encrypted file remaining confidential, then you have bigger problems than whether to use cloud storage or not.Ī sufficiently strong master password should prevent brute forcing at least long enough for a breach to be detected and for you to change the passwords within it. KeePass encrypts the DB because the file remaining secure isn't expected to be a guarantee. It is hard to quantify exactly, but if you have the DB on a mobile device then I wouldn't say this is particularly any less secure.
0 kommentar(er)
