Ask HN: Please critique my personal digital security strategy • Hacker News Board

Re: Ask HN: Please critique my personal digital security strategy

#21

Post by j_s » Mon, Sep 11, 2017, 12:46 PM UTC

Any consideration given to a hardware security token? The Yubikey NFC edition (~$50?) can even work with your phone.

https://helpdesk.lastpass.com/multifactor-authentication-opt...

At the very least, consider securing Lastpass with U2F (fairly cheap) once they support it.

https://cognitionsecure.com/u2f-otp-google-lastpass/

Be sure to get at least two hardware tokens in case of failure.

--

PS. Some more exotic options even store actual passwords rather than encryption keys.

https://www.tindie.com/products/stephanelec/mooltipass-mini-...

Re: Ask HN: Please critique my personal digital security strategy

#22

Post by j_s » Mon, Sep 11, 2017, 12:52 PM UTC

toocool wrote: post #5

philiphodgen wrote: post #4

And if (God forbid, because it could never happen) Google arbitrarily froze you out of your email account and you could not talk to a human at Google to remedy the situation . . . ?

Thanks for your reply. That is a possibility, I might be naive but I consider it on the very unlikely side. What I would imagine in that case is that I would reset the important other accounts such as the bank ones by showing up in some physical office with my passport, or something similar, while waiting to solve the situation with Google. What alternatives would you suggest? Spreading the accounts over different em…

Bare minimum: regularly scheduled 'take out' backups.

https://www.google.com/settings/takeout

There are lots of open source utilities to work with the data, but most are one-offs. Here's one that didn't appear to be:

https://github.com/jay0lee/got-your-back/wiki

Re: Ask HN: Please critique my personal digital security strategy

#23

Post by j_s » Mon, Sep 11, 2017, 12:55 PM UTC

toocool wrote: post #11

pmlnr wrote: post #9

I always wonder what has higher risks: me, hosting my own mail, maybe getting hacked, or a gmail user, risking being locked out forever due to posting something inappropiate in a youtube comment.

Haha I hope you're not being serious. If I had to estimate the probability of Google ever blocking my account over my life time I'd say 0.01%, whereas the probability of someone successfully attacking my mail server/dns records/... if I really became a target would be easily 100%.

Google Developer Account Wrongly Terminated NO MEANS OF DISCOURSE | https://news.ycombinator.com/item?id=15197357 (flagged, 44 comments, Sep 2017)

Don't ever do a chargeback! (This is actually a great way to shutdown an account you don't want...)