541–550 of 557 posts
Earlier quoted context omitted.
For an iPhone, a full backup via iTunes will include the authenticator app data, won't it? And you'll be printing out emergency passwords when you set up two-factor either way.
It doesn't look like this works with the google authenticator app when restoring to a different device. For emergency passwords, does that mean you're keeping a printed out copy with you when you travel?
Earlier quoted context omitted.
I have to disagree with the Authy recommendation. I switched to Authy a few years ago, but it was nothing but painful and I have recently migrated away from it. For a long time the "TouchID Prompt" was slow and buggy, but that does appear to be fixed now. The real pain point is that it managed to corrupt one of my keys (how??) and the app tries to get me to backup my keys to their servers with multiple popups (which…
a major advantage is if I throw my phone into the ocean(not a theoretical attack!) I can still recover my OTP on another machine. Authy offers this pretty nicely I would recommend testing theories of : - losing phone - losing computer - losing both and have reasonable backup strategies for these scenarios.
Earlier quoted context omitted.
My favourite was the unique email I used for a Russian visa application. Either the consulate was ridden with malware, or they just sold my address.
Were you actually at a consulate? Most russian visas are (pre)processed by private companies.
Earlier quoted context omitted.
Email RFC is weird. Did you know email addresses are supposed to be case sensitive? Like bob@ and Bob@ are two different addresses? Some services treat them this way, most don't. That intersection (oauth2 for example from Google can return Bob.Smith@domain.com if Bob has a GA4W account, which causes trouble when the oauth handler inconsistently lower-casifies input.
Really? By my reading RFC-5321 & RFC-5322 leaves interpretation of the local-part up to the software running on the host where the mail is delivered, but since that interpretation is up to those servers, intermediate servers must treat them as case sensitive and not make modifications to the local-part.
Earlier quoted context omitted.
You auth machines you use regularly so that login is 30 seconds once. That's not such a high penalty so that devices you've physically used are authorized and all others aren't.
I browse with tin foil hat settings so I authenticate multiple times a day.
It's hard to make a strong recommendation without knowing where on the scale of 1 to RMS you are...
[1] https://www.technologyreview.com/s/531926/a-physical-key-to-...
Earlier quoted context omitted.
Were you actually at a consulate? Most russian visas are (pre)processed by private companies.
Consulate. Most Russian visas in Europe are processed by consular services, unless you need it done quick and/or from a remote place.
Earlier quoted context omitted.
Although that feels secure, it's a poor way, security by obscurity is weak. As soon as some one realize, all your passwords will be revealed...
In order to determine the algo have_faith is using, an attacker would probably need a sample size of at least 4 passwords from different sites (at least, my algo definitely would). If an attacker has access to 4 of your passwords in plaintext, you have bigger fish to fry.
Earlier quoted context omitted.
All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just re…
How do you deal with websites that won't let you use >8char or certain characters? I use this same method, but my method will often generate special characters, and AWS as an example, and several others (apparently following AWS' lead) won't let you use those. (Any punctuation not on the shift-numbers row of USA keyboards are not considered legit for password use) I still mostly use this system, and given my lucky me…
Earlier quoted context omitted.
I browse with tin foil hat settings so I authenticate multiple times a day.
In that case, you might be better off investing in an OTP device? [1] It's hard to make a strong recommendation without knowing where on the scale of 1 to RMS you are... [1] https://www.technologyreview.com/s/531926/a-physical-key-to-...
For me I don't like staying logged into most services, I find it very uncomfortable that my computer "remembers" me for some reason. I use a browser plugin to delete cookies on tab close and don't save any history. I'm not so much RMS, just like my browser to "start fresh" most of the time. I also use a VPN 90% of the time.
So I value quick login more than account security, I guess.