KeePass is a wonderful tool that allows users to manage their passwords securely with encryption technologies. We live in the information age, and people have tens (sometimes hundreds) of passwords for various types of accounts such as email, device authentication, networking equipment logins, social media, online banking, and a multitude of other sensitive types of web resources. It can quickly become a nightmare trying to manage and remember all of the various usernames and passwords without resorting to password recovery mechanisms.
To combat this problem, common users often resort to one of two solutions. Sometimes they make their username and password the same across a large number of websites so they only need to remember one set of login credentials. But this is extremely unsecure, because if any single account becomes compromised, they all become accessible by the successful hacker. In addition, many users resort to using weak passwords so they are all easy to remember. Birthdays, pet names, and a spouse’s maiden name are often used and standard passwords. But this solution is also extremely weak since these passwords are easy to guess.
That’s where a password database comes in handy. KeePass stores all of your passwords on your local computer in an encrypted format so you never need to resort to password recovery again. The only problem is that users access the same web resources from a variety of devices including smartphones, tablets, desktops, and laptop computers. Trying to create the same password database for each device is tedious and time consuming unless you have a syncing service.
Advantages of Using Keepass with Drobox
On its own, KeePass isn’t a viable solution because users need to copy their password database across a wide variety of device types. But by using an online storage and syncing service such as DropBox, users will be able to access their passwords securely no matter what device they are using or where they are located in the world. The syncing feature adds even more value, though. Once a user enters a new username and password combination into the database, it automatically updates on all of their other devices, ensuring that the user doesn’t lose or forget a new set of login credentials.
Security Concerns
I know many of you are probably thinking that it is a massive security concern to store your entire password database in the cloud. After all, what would happen if DropBox became hacked or a rogue and bitter employee were to get their hands on your data? The good news is that it is completely impossible for anyone to access your passwords once they are stored on DropBox’s servers. This is all due to KeePass’s design and features. You see, KeePass users manage their encryption keys exclusively.
Because the master password is encrypted, it is impossible for third parties to crack the master password. In fact, if a user forgets their master password, the entire password database is rendered useless since there is no password recovery mechanism (having such a feature would defeat the purpose of the database!). So, even if a third party was able to get their hands on a copy of your password database, there’s absolutely nothing they can do to break into the database and steal your password – as long as you don’t share your master password with anyone else, that is.
Configuration Process
Before you can take advantage of cloud storage in conjunction with an incredibly strong password database, you are going to need to perform a few configuration steps as follows:
- First of all, you’re going to need a Dropbox account. They provide 2GB of lifetime free storage that can be expanded up to 16GB through their referral program. Most users have more data, though, so you may want to opt for their paid service which costs $9.99 for an entire terabyte of storage. Make sure your Dropbox service is installed before moving forward.
- Download and install KeePass. Remember that the classic edition only works on versions of Microsoft Windows 2000 and later editions. If you want support for Linux, BSD, and OS X devices, download and install the Professional edition.
- Open and run KeePass, and create a new password database by clicking on File and then New. Make sure you can remember your master password! The process of creating a new database will ask you where you want to store the database file. This is the most crucial step, because you need to save it in the Dropbox folder so it gets automatically synced and updated to the cloud.
Caveats
While this is one of the best and easiest ways to securely manage passwords across various devices, it does have some setbacks and limitations. The first of which is that KeePass isn’t supported on every major operating system and mobile device platform. The Android version, KeePassDroid, has read-only capabilities for KeePass 2.0 and later versions. Still, Android users can use version 1.X and won’t lose too many features when compared to 2.X.
In addition, you also have to enable Dropbox on your mobile devices to update new login credentials. If you want to add a new username and password to the database, you’ll have to be sure to open the password database from the Dropbox app, otherwise you will likely be using a local cached version of the database.
Sorry. Any encryption can be broken. It is totally possible for someone who gets your database to hack into the passwords. Storing the database on dropbox is significantly less secure than storing it on your physical devices and copying the databases to the physical devices for merging (you say this is not viable but it’s what my family does). You, and perhaps many of your users, may be comfortable with the extra risk of using dropbox for the keepass database storage, but it is misleading to the point of irresponsibility to say that there is no extra risk.
While it is true that any encryption can be broken, a secure complex password (16+ characters, alphanumeric + symbols) is complex to the point that brute force hacking the password would likely take decades or longer unless the hacker has dedicated access to a supercomputer for a lengthy period of time. If your password is randomly generated and not reused, dictionary attacks won’t fare much better. By this point, the encryption is basically your strongest point of defense.
If you choose the option of assigning a key file then it will be secure in Dropbox as long as you keep the key file locally and not in Dropbox.
Having the DB on Dropbox is safe, if the master-password is strong and known only to you, but you should NOT store your DB in the Dropbox folder, but rather store it locally on all computers and set up a copy in the Dropbox folder (which works as a master-DB) that you set to sync with the local DB from within each copy of the KeePass programm you use.