Is it safe to use Google Apps For Business: Spreadsheets to keep track of passwords?

Question

Google Apps for Business is supposed to be secure enough for corporate data, as described in their FAQ: http://www.google.com/apps/intl/en/business/faq.html

They say "We also undergo regular security reviews by third parties and SAS 70 audits by an independent third party. We fully believe in the security of our Google Apps environment that we store our own Google corporate data in the same environment."

Therefore, it should be safe to use Google Spreadsheets (Business) to keep track of passwords, right?

Answer 1

If you have doubts about it, then that's usually a pretty good "red flag" in my opinion.

The issue is that you are depending on a third party to store your security-related information. It just takes one bad employee (at your company as well as at a third-party company) to breach the trust and cause a lot of problems for you, and this is why encryption is so popular.

Although I have a great deal of confidence in Google's abilities to run their systems securely, and to select trustworthy employees, I still wouldn't store my passwords on their system unless I encrypted them on my own system before-hand (that way, they'd only get the encrypted version of the information).

Also consider the possibility of a third-party obtaining a court order for Google to provide full access to their customers' data. The nature of this court order could be that such access be kept secret from the customers as well. In this case I imagine that Google would have no choice but to comply with the law, and in the end you wouldn't really know who actually has access to your data.

My recommendation: Don't depend on third parties to store sensitive information if you don't have to (and if you have to, then only let them store encrypted versions of your data).

Answer 2

As far as I know, Google Docs are password protected but they are not encrypted, which means you do not want to store sensitive data there.

You may be interested in Passpack, an online service catering to those who need centralized, encrypted password management.

(Anecdotally, a combination of KeePass and Dropbox has been a successful password management solution for me.)

Answer 3

Anytime you store passwords or any other type of sensitive data, encryption should be part of the equation. Why would you want to store a list of passwords in such a way at all? I prefer using sqlite3 encrypted databases for password lists, but I only keep my password list on local storage, and any database engine would be fine, so long as it is encrypted. If you need to access and edit it company-wide, it should be on an intranet server.

Answer 4

I don't mean to sound curt, but storing passwords in something like a spreadsheet (or any document) defeats the purpose of passwords. In security terms your creating a "single point of failure". If someone gains access to your Google Docs account with the password spreadsheet then everything is compromised. While encrypted, online password management sites may seem like a better solution, you still have the same problem of someone gaining the password to the site and then all your other passwords. Any type of password storage system, whether encrypted or not, has the same problem. If that one password is compromised, so is everything else. This is not a way to implement security. Seriously, a pen, a notepad and a safe is better protection than than anything suggested so far, no offense.

Answer 5

You could limit the contest of the document to just usernames and server addresses. And then instruct your fellow team members (don’t keep these instructions in the document, obviously) to run the addresses, username, and a single secure agreed upon project master password through something like PwdHash. This should be much more secure than storing the passwords in a plain-text document.