May 31, 2016
Use of different passwords considered harmful
In the previous version of AxCrypt, it was sometimes necessary to use different passwords for different files. This happened when files were shared between different persons. Obviously you then needed to share the password as well, but you do not want to share your own password. So, for each set of persons sharing a file, a different password was needed.
Additionally, it happened that users would set different passwords for different files, even if they were only for private use. This may *feel* safer, but in fact at best it adds no security and at worst it causes a situation with *less* security.
The first scenario, sharing of encrypted files with other persons, is handled in AxCrypt by the Key Sharing feature. This will be discussed elsewhere, let it just be said here that it’s a much better way to achieve this benefit than different passwords.
The second, using different passwords for yourself, is a little counterintuitive perhaps but the truth is – there is no need, and no benefit. It might *feel* better, but it’s not the solution to any problem. One aspect is that having many passwords will most likely be more inconvenient and thus make you less prone to use encryption. That’s bad, you don’t have that added protection. Also, it increases the risk of forgetting one of them. That’s bad, you lose your data. If you have too many, you’ll have to use a password manager to keep track of them. That’s not necessarily bad, but it doesn’t improve anything either.
Using many passwords actually tend to decrease the practical security because it’s more inconvenient the barrier against use is higher, and also it’s simply too hard to keep track of many strong passwords. So the typical situation will be many weak passwords. Instead we’re saying that if you can handle one, strong password for all your files, we’ll make it convenient to use since you don’t have to enter it very often. This will in practical terms tend to increase security overall.
Security pundits have always looked for the holy grail of single sign on. We’re not there yet, and we won’t get there in our lifetime, but the main point is: Fewer passwords is better. That’s what we’re trying to achieve with AxCrypt 2.
So, instead of using different passwords for different files, set a good and strong password and use that. With AxCrypt 2, you’ll only have to type it once per session, then you have immediate access to all your files. One password to rule them all…
Regardless of whether you’re an old user of AxCrypt 1, or a new user, don’t fall into the multiple password trap. If you’re already in there, use AxCrypt and it’s auto conversion feature to quickly and easily get out of it!
Happy AxCrypting!
Svante, Developer and Co-Founder AxCrypt AB.