4 ms·

I use 1Password with Dropbox. Can someone tell me whether I'm at risk, and should donate to this project?

by Rygu 13y ago

geertj 13y ago
You are at risk of a dictionary attack on your password / passphrase. You need protect it with a long, computer generated passphrase to be secure. I would say at least 128 bits of entropy. By being stored on Dropbox, you have to assume that the the "agencies" have access to your database. At some point, computing will advance enough to either brute force the encryption or find a weakness in it. The safest option is to prevent 3rd parties from having access to your encrypted data in the first place. This is the approach Bluepass is taking.
- jpalomaki 13y ago
  The entropy problem you can go around with by encrypting the data with a combination of pass phrase and a token file. For example KeePass supports these kind of combinations. Obviously the token file would be something you don't put into cloud but instead store on each physical device.
mseebach 13y ago
Remember what you're protecting here: the keys to your data, not the data itself. You're at risk from the US government, but it's unclear that a government that can compel Dropbox to hand over your database and then crack some pretty heavy encryption can't access the accounts you're protecting with those passwords in some other way. The main adversaries, IMO, you're protecting against are non-government actors, and your setup should be completely adequate for those. FWIW, I have the same setup, but with Keepass.
falk 13y ago
It's been reported that Dropbox is "coming soon" to PRISM. http://www.theatlanticwire.com/technology/2013/06/prism-companies-start-denying-knowledge-nsa-program-collecting-their-users-data/65996/ http://www.theatlanticwire.com/technology/2013/06/prism-comp...
DanBC 13y ago
What are you protecting, and who are you protecting it against?
- alan_cx 13y ago
  How about: "What are you protecting," Freedom "and who are you protecting it against?" The US(UK) government.
  - DanBC 13y ago
    Assessing risk is a sensible part of securing your computers. The US / UK have imprisoned people without charge, trial or conviction, and based on flimsy evidence. Some of those people will have been tortured. Feel free to suggest 1password on dropbox, or Bluepass, if you think either of them can protect against well funded government agencies. I hope you're also recommending better door locks, no windows on the ground floor, 5 metre fences, hardened computer running hardened OS, etc.

I use 1Password with Dropbox. Can someone tell me whether I'm at risk, and should donate to this project?

by Rygu 13y ago

I use 1Password with Dropbox. Can someone tell me whether I'm at risk, and should donate to this project?

You are at risk of a dictionary attack on your password / passphrase. You need protect it with a long, computer generated passphrase to be secure. I would say at least 128 bits of entropy. By being stored on Dropbox, you have to assume that the the "agencies" have access to your database. At some point, computing will advance enough to either brute force the encryption or find a weakness in it. The safest option is to prevent 3rd parties from having access to your encrypted data in the first place. This is the approach Bluepass is taking.

jpalomaki 13y ago
The entropy problem you can go around with by encrypting the data with a combination of pass phrase and a token file. For example KeePass supports these kind of combinations. Obviously the token file would be something you don't put into cloud but instead store on each physical device.

mseebach 13y ago

Remember what you're protecting here: the keys to your data, not the data itself. You're at risk from the US government, but it's unclear that a government that can compel Dropbox to hand over your database and then crack some pretty heavy encryption can't access the accounts you're protecting with those passwords in some other way. The main adversaries, IMO, you're protecting against are non-government actors, and your setup should be completely adequate for those. FWIW, I have the same setup, but with Keepass.

falk 13y ago

It's been reported that Dropbox is "coming soon" to PRISM. http://www.theatlanticwire.com/technology/2013/06/prism-companies-start-denying-knowledge-nsa-program-collecting-their-users-data/65996/ http://www.theatlanticwire.com/technology/2013/06/prism-comp...

DanBC 13y ago

What are you protecting, and who are you protecting it against?

alan_cx 13y ago
How about: "What are you protecting," Freedom "and who are you protecting it against?" The US(UK) government.
- DanBC 13y ago
  Assessing risk is a sensible part of securing your computers. The US / UK have imprisoned people without charge, trial or conviction, and based on flimsy evidence. Some of those people will have been tortured. Feel free to suggest 1password on dropbox, or Bluepass, if you think either of them can protect against well funded government agencies. I hope you're also recommending better door locks, no windows on the ground floor, 5 metre fences, hardened computer running hardened OS, etc.