Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

Google Apps for Business is supposed to be secure enough for corporate data, as described in their FAQ: http://www.google.com/apps/intl/en/business/faq.html

They say "We also undergo regular security reviews by third parties and SAS 70 audits by an independent third party. We fully believe in the security of our Google Apps environment that we store our own Google corporate data in the same environment."

Therefore, it should be safe to use Google Spreadsheets (Business) to keep track of passwords, right?

share|improve this question
add comment

migrated from superuser.com Mar 7 '11 at 6:42

This question came from our site for computer enthusiasts and power users.

5 Answers

If you have doubts about it, then that's usually a pretty good "red flag" in my opinion.

The issue is that you are depending on a third party to store your security-related information. It just takes one bad employee (at your company as well as at a third-party company) to breach the trust and cause a lot of problems for you, and this is why encryption is so popular.

Although I have a great deal of confidence in Google's abilities to run their systems securely, and to select trustworthy employees, I still wouldn't store my passwords on their system unless I encrypted them on my own system before-hand (that way, they'd only get the encrypted version of the information).

Also consider the possibility of a third-party obtaining a court order for Google to provide full access to their customers' data. The nature of this court order could be that such access be kept secret from the customers as well. In this case I imagine that Google would have no choice but to comply with the law, and in the end you wouldn't really know who actually has access to your data.

My recommendation: Don't depend on third parties to store sensitive information if you don't have to (and if you have to, then only let them store encrypted versions of your data).

share|improve this answer
    
Is a single employee in Google actually able to compromise our data in Google Docs? –  Pacerier 9 hours ago
add comment

As far as I know, Google Docs are password protected but they are not encrypted, which means you do not want to store sensitive data there.

You may be interested in Passpack, an online service catering to those who need centralized, encrypted password management.

(Anecdotally, a combination of KeePass and Dropbox has been a successful password management solution for me.)

share|improve this answer
    
Is Dropbox secure for this? –  Pacerier Mar 29 at 1:38
    
Not exactly, but the Keepass db itself is encrypted. –  goblinbox yesterday
    
@golinbox, Then we might as well use KeePass with Google Docs instead of DropBox....... –  Pacerier 9 hours ago
add comment

Anytime you store passwords or any other type of sensitive data, encryption should be part of the equation. Why would you want to store a list of passwords in such a way at all? I prefer using sqlite3 encrypted databases for password lists, but I only keep my password list on local storage, and any database engine would be fine, so long as it is encrypted. If you need to access and edit it company-wide, it should be on an intranet server.

share|improve this answer
add comment

I don't mean to sound curt, but storing passwords in something like a spreadsheet (or any document) defeats the purpose of passwords. In security terms your creating a "single point of failure". If someone gains access to your Google Docs account with the password spreadsheet then everything is compromised. While encrypted, online password management sites may seem like a better solution, you still have the same problem of someone gaining the password to the site and then all your other passwords. Any type of password storage system, whether encrypted or not, has the same problem. If that one password is compromised, so is everything else. This is not a way to implement security. Seriously, a pen, a notepad and a safe is better protection than than anything suggested so far, no offense.

share|improve this answer
add comment

You could limit the contest of the document to just usernames and server addresses. And then instruct your fellow team members (don’t keep these instructions in the document, obviously) to run the addresses, username, and a single secure agreed upon project master password through something like PwdHash. This should be much more secure than storing the passwords in a plain-text document.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.