31–40 of 557 posts
Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it…
Earlier quoted context omitted.
Public-key crypto. Client side X.509 certificates for the web. S/MIME and OpenPGP keys for email. OpenSSH keys for SSH. etc
We tried using X.509 certificates in Denmark for proving your identity to the state. It was a complete nightmare unless you understood what public key crypto is, how it works, and how to configure your browser for it. Don't get me started about having to move your certificate/keys around. It doesn't work for the masses.
I don't know how feasible it would be to replace passwords for the general public, but if browser vendors were actually serious about security, they could go a very long way towards making client certs feasible just by giving up on their current strategy of putting their fingers in their ears and pretending it doesn't exist.
Oh well, another HIBP entry with my email address...
Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of being here and being interested in security), go and get them one now! 1Password now has a subscription service for $3 a month and you get the first 6 months for free. How about...not? There are tiny open source tools for every OS. You can do it locally, save it…
Earlier quoted context omitted.
I'd love it if every time I wanted to log in, I entered my username/email, saw a two factor-auth, and had an email sent with a time sensitive link containing my session credentials. But this would be a pain in the ass if I had a slow connection or used an old email address. And worse, it be totally unsafe if I could (easily?) change the email address attached to the account.
magic link. That's what medium does for email logins, and slack offers the option as well. it's easily one of the safest methods
Since lots of people will be rotating passwords, this is probably a good time to set up Two-Factor Authentication (2FA) as well. I recommend Authy as your 2FA app, as it lets you set a backup password, which you can use to move your 2FA tokens between devices. For your critical services, keeping encrypted copies of your backup codes is a must.
Note the hack was in 2012. Hopefully most people have rotated passwords by now.
Earlier quoted context omitted.
I'd love it if every time I wanted to log in, I entered my username/email, saw a two factor-auth, and had an email sent with a time sensitive link containing my session credentials. But this would be a pain in the ass if I had a slow connection or used an old email address. And worse, it be totally unsafe if I could (easily?) change the email address attached to the account.
magic link. That's what medium does for email logins, and slack offers the option as well. it's easily one of the safest methods
It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…
- Useful as a canary of which website has been breached
- Useful as a canary of which website sold your details
- and if your details are in the wild, you can stop the spam by deleting the address
Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor.