I have my keypassX database and my private key stores in my dropbox account. Am I stupid?

Both files are encrypted with a long password (20+ chars, caps, symbols)

I have opened my keypassx DB directly from my dropbox folder.

All this from clearnet and windows. My dropbox is undoubtfully linked to my person (mail, documents with my name, etc)

Have I fucked up?

EDIT: typo, I meant 'stored' not 'stores'.


Comments


[1 Points] None:

I suppose on one level it isn't the most brilliant thing in the world. But on the other hand, it's going to depend on what they're used for and what sort of information you have floating around out there that someone with access to your private key might be able to decrypt.

If you're someone who has just made a couple orders here and there, I wouldn't worry about it. If you're a vendor with gobs of sensitive information, then yeah, I would probably wipe that all and start over. But I am assuming you're the former and not the latter, so I wouldn't get worked up about it at all. How familiar are you with PGP and encryption in general? How much do you use markets or deal with encrypted messages?


[1 Points] shady_varchar:

If your stuff was encrypted before it was put into dropbox, then your fine. But if you decrypt your files inside dropbox, then you can potentially be screwed. That is if it wasn't decryped into memory and was written to file.


[1 Points] Theeconomist1:

I think I know what you are getting at. Are you asking that b/c you have the file on the network, when you unlock your KeePassX file, does the "unencrypted" view ever get persisted back, such as in temp file, or transmitted plaintext over the network? Good question. I don't know their code so this is all my opinion on how I would think it works BUT I would think that you would be alright in that regard. I would think that KeePassX would read the file, whether it be local or on the network somewhere, load it into memory (RAM). When you provide the password, its unencrypted in your RAM and this unencrypted version never gets transmitted over the network or back to disk unencrypted. When you update/save it, it encrypts it in RAM THEN sends the encrypted file to disk (or over the network).

I would hope that KeePassX never moves the unencrypted version back to disk as a temp file or any other type of file. I'm guessing they don't do that and the unencrypted version of your file for viewing purposes is always just in RAM. Otherwise its useless.


[1 Points] sharpshooter789:

Use base64 encoding (+encryption obviously) and you can store it on pastebin safely. Just make sure you don't do it from an account and you make the post nonpublic.


[1 Points] mbobe:

For the really important passwords (like bank accounts, some of my personal health care accounts, etc) keypassx, but with Tresorit. You surely won't have the decryption issue with them, since it is end-to-end encrypted.