Gracepoint After Five

Ok, I confess, I keep all my passwords in a single text file, and I keep it stored online.

How am I supposed to remember my username and password to the Oracle iExpense thingy at work?  Or the Member ID for my health insurance?  I gotta keep them online so that info is available whether I’m at work or at home.

Maybe I’ll be the next cyber-theft victim like the poor folks at Twitter who had their corporate documents compromised since they stored it all online using Google for Domains.  Tsk tsk.

Well, the way I’ve been able to pull if off and sleep peacefully at night is using a combination of some awesome Mac tools (I’m sure there’s a similar PC equivalent):

• Dropbox: Online storage volume, backend is actually Amazon’s S3 service
• TrueCrypt: Open-source on-the-fly volume encryption — allows to you quickly mount and unmount secure volumes.

Dropbox is a great tool available for Windows and OS X that allows you to keep a virtual disk online, available everywhere.  I know there are many other similar services and I’ve tried my share.  However, I’m a big believer in Dropbox because it never crashes and never misses a sync.  You can be moving files around in it, copying a large file in there, and then for kicks, yank the internet connection.  Next time you log in, it syncs flawlessly.  Beauteous!

Inside Dropbox, I store an encrypted file container created by TrueCrypt.  I can mount that file container like a USB drive, and I can in turn store sensitive files in there.

I know there are password websites out there but I just don’t trust some third party to store my passwords.  ”Store all your passwords in a single place!”  Something about that value proposition gives me the creeps!  Well, those sites are dime a dozen, and all startupy.  Not my idea of real security.  Ultimately, I want to be the only one who has the keys to the safe.  There’s a similar technique which uses Disk Utility to create a password protected AES-encrypted .DMG file, but that requires you to remember to never click “Save Password” when decrypting it and the disk image itself is read-only so it’s a pain to make changes to its contents.

Creating your Encrypted File Container

After you install Dropbox, create a folder called Secure which will have a file called Secure Files (in case it isn’t any clearer):

Secure Files is actually an encrypted file container created by TrueCrypt.  That’s basically fancy lingo for a .DMG disk image volume that has strong encryption (I’m using Serpent-Twofish-AES … three ciphers in cascade).  You can easily create one using TrueCypt by clicking on Create Volume:

Save your encrypted file container in your Dropbox’s Secure folder or save it to your desktop and copy to Dropbox later.  For the Encryption algorithm, it’s up to you.  I chose the Serpent-Twofish-AES since it’s basically impossible to break.  Next, set a volume size of 50MB (more if you need to store lots of stuff in there).  Create a volume password (a very long one preferably and one you don’t use elsewhere) and a filesystem type (I’m using FAT for highest compatibility) and format the volume.

Now, drag your encrypted file container from Dropbox to TrueCrypt and mount it.  Volia!  Super-secure disk image to go.  You can drag important documents and password files directly into the mounted volume (shows up like a USB disk in Finder):

When you unmount the volume (either through TrueCrypt or Finder), it is automatically re-encrypted.  Even if your Dropbox account is somehow compromised, your secure volume files remain encrypted and protected.

I also keep a copy of the TrueCrypt application inside the Secure Files folder in case I’m on a Mac that doesn’t have it.

Now you can keep your password file guilt-free!

Categorized as Tech