Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PAM Duress – Alternate passwords for panic situations

github.com

Post reply on HN
Print view View original

301–310 of 358 posts

Re: PAM Duress – Alternate passwords for panic situations

#301

Post by bennyp101 »

another-dave wrote: post #295
bennyp101 wrote: post #265

Earlier quoted context omitted.

Most banks here (UK) have a mobile app, so I've always wondered why they don't use that to auth the call? Bank: Hey I'm calling from HSBC, want to verify it? Me: Sure Bank: Ok, so open you mobile app, and enter 637482 Me: Ok, cool thats given me 274893 Bank: Yep, that's all confirmed so ...

That would save you giving out personal details to authenticate yourself, but may lull people into dropping their guard & divulging personal details before the bank authenticates on _their side_ — as in, nothing in that script prevents a scammer saying "Yep, that's all confirmed" no matter what the person says & then a lay person may feel more secure even though they've proved nothing

I was thinking more that once you put the code in, it says that it is a valid call (or not) then you get the response code to give back - at that point they can continue as normal

Re: PAM Duress – Alternate passwords for panic situations

#302

Post by michael-ax »

mgbmtl wrote: post #150
michael-ax wrote: post #99

perhaps i could use that as a screensaver password to share with my girlfriend? it would close spreadsheets, emacs, un-mount journals and personal drives. PAM's used to reauth from the screen-saver, right?

Might be easier to create a separate login? Some partners expect to share passwords as a trust thing, but my work does not allow it (and most personal devices have access to work stuff).

Yes, those _are good, i have an Alt-F9 alternate desktop for guests, but a 2 letter password for her to bypass the screen-lock and change the music or something would in fact remove my sometimes duress, i think..

Re: PAM Duress – Alternate passwords for panic situations

#303

Post by michael-ax »

wowaname wrote: post #175
michael-ax wrote: post #99

perhaps i could use that as a screensaver password to share with my girlfriend? it would close spreadsheets, emacs, un-mount journals and personal drives. PAM's used to reauth from the screen-saver, right?

Depends on your locking program but yes, PAM can be used for that.

Thank you, I think I'll rig that up.

Re: PAM Duress – Alternate passwords for panic situations

#304

Post by wowaname »

rafael859 wrote: post #15

Nice, pretty cool stuff. In high-school I worked on something similar ( https://github.com/rafket/pam_duress ), though this seems to have a somewhat cleaner implementation which is nice to see, and hopefully a more eager maintainer.

There are some issues with nuvious' pam-duress that allow for untrusted string inputs when handling scripts with system() call, and I sent a patch to them via E-mail in an attempt to highlight the issues and provide a basis for a better way to handle it.

Re: PAM Duress – Alternate passwords for panic situations

#305

Post by michael-ax »

wowaname wrote: post #176
mgbmtl wrote: post #150

Earlier quoted context omitted.

Might be easier to create a separate login? Some partners expect to share passwords as a trust thing, but my work does not allow it (and most personal devices have access to work stuff).

I don't understand why partners willingly share passwords.

why do passwords cover accounts not scopes?

if passwords also covered account scopes -- which is what this tool enables one to monkey-patch into the OS, i could give you my password so you could gorge on my code without me having to worry about you reading my journals or abusing ~/.ssh

other than that, i second your notion.

I'm thrilled by the idea of using passwords to switch between the sorts of things i do without having to log-out.

Re: PAM Duress – Alternate passwords for panic situations

#306

Post by taneliv »

tyingq wrote: post #6
solatic wrote: post #4

I mean, that's pretty cool, but who enables password logins for SSH anymore? If I'm an attacker, I'm going to wonder why my target of duress is giving me a password and not a private key; most likely if I have access to my target of duress, then I have access to some kind of client / endpoint that my target uses to connect to the network, and that client will have the SSH private keys likely already loaded into ssh-a…

Pam is for more than just ssh. This could wipe data on a Linux machine for a local login, gdm, sudo, and so on.

Yes, and perhaps _not_ use pam_duress for remote logins, in case you want to keep your duress password simple (think "password" or something similar, actually memorable in a duress situation).

Re: PAM Duress – Alternate passwords for panic situations

#307

Post by jaywalk »

nextlevelwizard wrote: post #276
pyuser583 wrote: post #263

Earlier quoted context omitted.

In the US they can’t do anything unless they have “probable cause” you committed a crime. That’s broad, but it excludes “this guy pushed the number 6 three times in a row.” And “imprison” and “arrest” are pretty darn close. In the US, when you are arrested, you are usually searched, fingerprinted, and a mugshot is taken. The mugshot can become a public record. There are websites that match mugshots to names, and make…

Probable cause isn't "pushed button multiple times" it is "silent alarm was triggered and this guy is on the only guy in the building". If US is doing stupid shit then US is doing stupid shit. What else can we expect a third world country to do? In civilized world you are processed yes, but since you are just arrested and not accused you will just be held until the pre-investigation has concluded

In the US, what you're talking about is referred to as "detainment" which is very different from an arrest. I think that's where a lot of the confusion is coming from.

Re: PAM Duress – Alternate passwords for panic situations

#308

Post by 35fbe7d3d5b9 »

matrixagent wrote: post #279
oasisbob wrote: post #241

Earlier quoted context omitted.

No arrests. False alarms on silent alarm systems are common. Other factors made it clear that a real threat was unlikely. All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems.

> All orgs should consider locking out all employees for at least one uninterrupted week a year. Very easy way to shake out all sorts of problems. Could you give some examples?

As JulianMorrison notes, this is common in finance. The FDIC strongly recommends that banks enforce this[1] – you can't cook the books when you have no access to the systems.

But sometimes it's not just about cooking the books: the last "SSL cert expiration" fire I lived through happened because the person who had credentials to Digicert had to take sick leave. It was never a documented/defined process because "just flip Tim an email" was always sufficient, Tim didn't mind doing the work, and Tim didn't like going on vacation.

Two week lockouts mean there's no chance of shadow IT/back channel work happening, and forces you to document your processes.

[1]: https://www.fdic.gov/news/financial-institution-letters/1995...

Re: PAM Duress – Alternate passwords for panic situations

#309

Post by 35fbe7d3d5b9 »

csunbird wrote: post #281
gnicholas wrote: post #205

Earlier quoted context omitted.

Relatedly, make sure you trigger the password lock on your device before handing it over. They may be able to compel you to give your biometrics but not your password (the latter is considered compelled speech, and the courts have not fully litigated whether the former is treated the same).

For iphones, just tap the power button repeatedly, it will force a password entry to unlock.

If you have Siri enabled, you can also say "Hey Siri, whose phone is this?" – Siri will answer whose phone it is, but also will disable Touch/Face ID.

Do one of these things at the beginning of any custodial situation.

Re: PAM Duress – Alternate passwords for panic situations

#310

Post by jaywalk »

csunbird wrote: post #281
gnicholas wrote: post #205

Earlier quoted context omitted.

Relatedly, make sure you trigger the password lock on your device before handing it over. They may be able to compel you to give your biometrics but not your password (the latter is considered compelled speech, and the courts have not fully litigated whether the former is treated the same).

For iphones, just tap the power button repeatedly, it will force a password entry to unlock.

5 presses, to be exact.
Post reply on HN