Is a .sparseimage file with a strong password safe

Security

I have created a .sparseimage file of my Home folder on my 2009 iMac running OS 10.11.2 and have chosen a 17 character password which https://www.grc.com/haystack.htm notes that against an Offline Fast Attack Scenario (Assuming one hundred billion guesses per second) it would take 11.52 million trillion centuries to break.

My intention was to move it to my iCloud account but I find I cannot do so because it exceeds the limitation on file sizes that one is allowed to upload to one's iCloud account.

My question is, am I risking the possible compromise of this file by storing in on my Dropbox account? It has financial and other legal info that I would never want compromised.

Best Answer

Your password will not be compromised by a brute-force attack. More likely it will fall to some other attack such as a password grabber or malware. Your computer will be able to open the sparseimage and therefore the obvious target to attack is your computer. The sparseimage and its password is safe enough, but you should ask yourself a few questions about why you want to approach securing your data this way.

  • Consider securing your high-value data in a small encrypted sparsebundle image within your Home folder, rather than unsecured within your Home folder and then trying to password protect it when you copy the whole Home folder into Dropbox
  • Storing your home folder in Dropbox sounds to me like a poor design (I am not a security expert). If you are looking for backup plans then Time Machine disks can be password protected too (this results in a sparsebundle protected by a strong password. Your Time Machine disk image, and the multiple machine snapshots which it contains, can then be stored in an off-site store of your choice. The Time Machine disk image can only be accessed with your strong password
  • Take care when trusting to estimates of password strength. A 17 character password can appear to be strong to an algorithm designed only to look for length and variety, but may well appear in the many non-dictionary password tables. For example "passwordpassword!" Contains 17 characters, but you can be sure that someone somewhere has already used it and it probably appears in a huge password table somewhere.
Related Question