Hacker News Reader

Comment by Rygu | Hacker News Reader

I use 1Password with Dropbox. Can someone tell me whether I'm at risk, and should donate to this project?

Remember what you're protecting here: the keys to your data, not the data itself.

You're at risk from the US government, but it's unclear that a government that can compel Dropbox to hand over your database and then crack some pretty heavy encryption can't access the accounts you're protecting with those passwords in some other way.

The main adversaries, IMO, you're protecting against are non-government actors, and your setup should be completely adequate for those.

FWIW, I have the same setup, but with Keepass.

It's been reported that Dropbox is "coming soon" to PRISM.

http://www.theatlanticwire.com/technology/2013/06/prism-comp...

You are at risk of a dictionary attack on your password / passphrase. You need protect it with a long, computer generated passphrase to be secure. I would say at least 128 bits of entropy. By being stored on Dropbox, you have to assume that the the "agencies" have access to your database. At some point, computing will advance enough to either brute force the encryption or find a weakness in it.

The safest option is to prevent 3rd parties from having access to your encrypted data in the first place. This is the approach Bluepass is taking.

The entropy problem you can go around with by encrypting the data with a combination of pass phrase and a token file. For example KeePass supports these kind of combinations.

Obviously the token file would be something you don't put into cloud but instead store on each physical device.

What are you protecting, and who are you protecting it against?

How about:

"What are you protecting,"

Freedom

"and who are you protecting it against?"

The US(UK) government.

Assessing risk is a sensible part of securing your computers.

The US / UK have imprisoned people without charge, trial or conviction, and based on flimsy evidence. Some of those people will have been tortured.

Feel free to suggest 1password on dropbox, or Bluepass, if you think either of them can protect against well funded government agencies. I hope you're also recommending better door locks, no windows on the ground floor, 5 metre fences, hardened computer running hardened OS, etc.

Reply on news.ycombinator.com