58

Is it safe to keep KeePass password database file in Dropbox? Database can have long (14+ alpha, numeric, special character) password and local Key file on machine or on mobile which is not shared in Dropbox?

Improve this question
7
  • 1
    Passwords should not be stored where others can see them (like Dropbox).
    – m0skit0
    Oct 28, 2011 at 10:47
  • 3
    Others cannot see my password file as Dropbox keeps file strictly with my login unless I have kept it in shared folder.
    – TusharG
    Oct 28, 2011 at 10:52
  • 1
    Dropbox server administrators?
    – m0skit0
    Oct 28, 2011 at 10:53
  • Dropbox had a major security glitch where everyone could fully access any account.
    – slhck
    Oct 28, 2011 at 10:59
  • 8
    Having a security glitch and having it as a standard feature arn't quite the same thing. Besides keepass uses its own encryption.
    – Sirex
    Oct 28, 2011 at 14:03

2 Answers 2

Reset to default
44

The question here is not whether you trust dropbox, but whether you trust keypass. If your password vault gives up its secrets when someone else gets hold of it, then you will want to find something else.

Keypass uses AES-256 for encryption, which remains the de facto standard, and SHA-256 to create a key from your passphrase along with a salt.

So the encryption method is good. So then you'll want to consider if there are any implementation weaknesses that can be exploited by someone getting hold of your vault. Well keepass seems to do a rolling encryption method, where the file is split into blocks and multiply encrypted. A brute force attack would take time, and you can increase the keys per second that can be tested when creating the database. Choose for it to do many rounds. This means that it takes time for a key to be tested. For you, it means you have to wait for a second or so for the database to open. For an attacker, it means they have to wait a second or so to test their next key.

There are other protection methods employed, but aren't relevant to this scenario, like keeping the vault contents encrypted in memory when the vault is open.

You should review the security methods used, and if you feel happy that if the vault fell into the wrong hands that you'd be safe, then go for it.

Improve this answer
8
  • 1
    For me it is very important to get access of keepass database on my mobile however keeping it in sync is a big problem. For now I'll take a chance and use complex big password with local Key file as double security and keep it in dropbox while I will store key file on mobile filesystem and on HDD on computer. I know their is a risk.
    – TusharG
    Oct 28, 2011 at 17:54
  • 2
    What happens in the (very distant) future when AES-256 will be breakable? Dropbox keeps old revisions of files, so your passwords will be at risk, even if you have upgraded to a more secure mechanism by then. Any thoughts?
    – doublehelix
    Jun 17, 2012 at 17:21
  • 1
    @flixfe It keeps 30 days of revisions, so there is a window of opportunity there. A delete feature request to dropbox, or an alternative cloud storage solution that permits deletes of revisions or doesn't have them at all would fix this.
    – Paul
    Jun 17, 2012 at 22:16
  • 1
    Even if the AES-256 breaks. Getting access of my password database file is not enough as my database needs password and a local Key file to open the database. Also I checked how keepass works it never creats any unencryped swap file which can be later retrived on dropbox so it is very very safe I feel. All it creats a file which says database is unlocked.
    – TusharG
    Jun 21, 2012 at 12:38
  • 2
    @TusharG: AES-256 is being discussed as the Keepass protection; hence, if AES-256 were broken and you have the database, you don't need either the key file or the password to look at its contents. However, the problem doesn't exist: when AES-256 will have been slowly broken, if Keepass is still well maintained it will have migrated to a different encryption standard much more than 30 days before.
    – Blaisorblade
    Jul 8, 2013 at 9:33
5

There are different degrees of security, and the convenience of Dropbox versus the security of what you're trying to do are something you'll need to evaluate for yourself.

Also, security depends upon the weakest point. If any of the following are compromised, then your files are exposed:

  • You (forget to log out, leave your password on a sticky, share your dropbox with someone else)
  • Every computer you have Dropbox synced to. Are they using strong passwords? Software up-to-date? Are their disks encrypted? Do they have autologin turned on?
  • Your network connection to Dropbox. Do you have a firewall? Is your modem/router's firmware/software up-to-date? Are they configured properly?
  • Dropbox's software, network and computers.
  • Amazon S3 (where your files are stored).

Consider the following and that may be able to help you make that decision:

  1. The database file will be stored on every computer you have your dropbox installed.
  2. Dropbox stores a backup copy of the file locally, even when you delete the file.
  3. You need to ensure that the folder you're storing the file in is not marked public.
  4. It is possible for someone at the company to read your files. According to the information at the link, only a select few people have access to your data and they supposedly only will access it if subpoenaed.
  5. Dropbox stores your files on Amazon S3, which means that it is possible (albeit very unlikely: they'd have to be able to decrypt it) for someone at Amazon to access your data.
Improve this answer
1
  • 8
    This all talks about Dropbox security and its encryption. However how safe is KeePass database without key file? Can anyone decrypt KeePass database without password and Key file?
    – TusharG
    Oct 28, 2011 at 11:09

Not the answer you're looking for? Browse other questions tagged .