Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux workstation security checklist

github.com

Post reply on HN
Print view View original

161–165 of 165 posts

Re: Linux workstation security checklist

#161

Post by Tenhundfeld »

yellowapple wrote: post #136
Tenhundfeld wrote: post #81

Earlier quoted context omitted.

Absolutely. I use a password manager for everything except a handful of ultra-critical sites, mostly things involving money or attack vectors to get access to my email. For those sites I don't trust to store in LastPass, I write the passwords down on paper. But I also do something I haven't seen others recommend: Have a (logical) salt for all of the passwords. Don't write down that salt. So, if you found my piece of…

> *And I actually use initialism for these passwords so I don't have to pull out the piece of paper often, only when I forget. In this example, the Etrade password might be derived from "In 1999 I bought my first stock as a young man. I wish I bought more of it." Ideally, you'd just set "In 1999 I bought my first stock as a young man. I wish I bought more of it." as your actual password :)

Can't really argue with that. I guess got this in habit of using initialisms, because a lot of sites had limits of 32 characters for passwords.

But that's probably less true these days. Since they should be hashing the password anyway, why not allow something huge, say up to 1000 characters.

Re: Linux workstation security checklist

#162

Post by yellowapple »

vonuebelgarten wrote: post #145
yellowapple wrote: post #138

Earlier quoted context omitted.

Ideally, you wouldn't even have a dedicated swap partition. No data is always more secure than even the most perfectly-encrypted data. If you do have swap, though, then the encryption probably won't matter much compared to the fact that your machine is swapping in the first place.

Hibernation is a very nice feature (I use it for laptop and desktop machines) and it requires a swap partition. Also, a encrypted swap is even more important in this scenario. In the laptop I'm typing this, swap is one of the partions over a LVM2 physical volume over LUKS.

That's why I sad "ideally" :)

Re: Linux workstation security checklist

#163

Post by wtbob »

splme wrote: post #159
wtbob wrote: post #59

Earlier quoted context omitted.

And, last I checked, SpiderOak's protocol actually has a flaw: they could potentially store a copy of one's initial key. I emailed them about this, but not response. Cyphertite was really interesting, but it sounds like they're going out of business.

That's why SpiderOak moved from browser-based signup to in-app signup, to eliminate this possibility. (The switch was made in April 2015.) discaimer: I work for SpiderOak, but the response is my own.

That's really good to know! I'll have to check it out again—other than that one flaw, it looked like a really smart set-up.

Re: Linux workstation security checklist

#164

Post by jmnicolas »

lordsper wrote: post #58
jmnicolas wrote: post #54

Earlier quoted context omitted.

I have a fully airgaped and True-Crypt encrypted computer and don't feel secure at all. I guess it all depends on the attacker you envision and the trust (or lack thereof) you have in your encryption software.

What kind of breaches do you fear with your air-gapped setup?

The Police.
Post reply on HN