The Personal Security Checklist • Hacker News Board

Re: The Personal Security Checklist

#51

Post by PennRobotics » Mon, Apr 04, 2022, 10:20 AM UTC

blfr wrote: post #41

PennRobotics wrote: post #38

There's an obvious tradeoff having an authenticator (2FA/OTP) separate from your secure password manager. If you lose the device with credentials, you're screwed. It's really easy to lose access to a device (and usually without advance notice). Or you can override the 2FA, and then you're back to hoping the verification procedure of overriding 2FA is stronger than a dedicated attacker. A password manager managing 10…

> Maybe the best strategy is a hardware key with printed backup code? Or register more than one (preferably three) hardware key. It sidesteps all of these issues. They are very resilient and act as backups.

You still need to store one backup key somewhere safe, and then it's no longer something you have but something you hope stays where you left it.

Re: The Personal Security Checklist

#52

Post by PostOnce » Mon, Apr 04, 2022, 10:22 AM UTC

FabHK wrote: post #36

ihateolives wrote: post #35

Earlier quoted context omitted.

> statement about dictionary words being really crackable Every time I see this statement I immediately think: which dictionary? There are more languages than usual suspects (eg English, Spanish, French, Italian, German, Mandarin) and L1/L2 speakers of those make up sizable portion of internet users. Are Welsh/Hungarian/Slovak dictionary words really as easily crackable than English ones? If you have dictionary for t…

So, yes.

Exactly. I don't have to speak any of the languages on wikipedia to use wikipedia as dictionary for cracking. You can have every quote from every book, every place name, every wikipedia article, every song lyric, and a cheap GPU can buzz through it all ... fast.

Kind of breathtaking that we have that power now, and kind of terrifying.

Re: The Personal Security Checklist

#53

Post by ravenstine » Mon, Apr 04, 2022, 10:22 AM UTC

> Don't reuse Passwords

Nice in theory, and perhaps in practice if one uses a password manager that's unified across devices.

In my opinion, password managers are a ticking time bomb. With maybe the exception of something like Firefox's built in password management, it's only a matter of time before these for-profit password managers are subject to significant exploits or data leaks.

With strong 2FA, the necessity of not reusing passwords is much less relevant and hardly warrants forcing users to reset their password while disallowing use of previous passwords. If a user enables strong 2FA, they should be allowed to keep the same password indefinitely.

Re: The Personal Security Checklist

#54

Post by loevborg » Mon, Apr 04, 2022, 10:29 AM UTC

CalChris wrote: post #8

With respect to password managers, it doesn't mention Apple's iCloud Keychain. Any reason why?

You can't use it with Chrome, so you're locked into Safari forever.

Re: The Personal Security Checklist

#55

Post by Thorentis » Mon, Apr 04, 2022, 10:36 AM UTC

ravenstine wrote: post #53

> Don't reuse Passwords Nice in theory, and perhaps in practice if one uses a password manager that's unified across devices. In my opinion, password managers are a ticking time bomb. With maybe the exception of something like Firefox's built in password management, it's only a matter of time before these for-profit password managers are subject to significant exploits or data leaks. With strong 2FA, the necessity of…

KeePassXC is the exception to this. It is open source, and doesn't rely on another service (you can just put the file in Dropbox or something). Anybody who is seriously about security should be using it.

Re: The Personal Security Checklist

#56

Post by Aachen » Mon, Apr 04, 2022, 10:43 AM UTC

PostOnce wrote: post #52

FabHK wrote: post #36

Earlier quoted context omitted.

So, yes.

Exactly. I don't have to speak any of the languages on wikipedia to use wikipedia as dictionary for cracking. You can have every quote from every book, every place name, every wikipedia article, every song lyric, and a cheap GPU can buzz through it all ... fast. Kind of breathtaking that we have that power now, and kind of terrifying.

This is exactly what I did for a research project in school: download Wikipedia, extract all combinations of iirc 2-5 words, do a few transformations like adding a lowercase variant and space-less variant, and run that set against the LinkedIn sha1 password dump. Quite effective for cracking passphrases that weren't randomly chosen words but an existing phrase.

Re: The Personal Security Checklist

#57

Post by robjan » Mon, Apr 04, 2022, 10:44 AM UTC

mr_mitm wrote: post #48

Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

A typical password manager is two factors: something you have (the password database) and something you know (the master password).

A typical password manager is BitWarden or LastPass which is on the cloud and only requires your master password.

Re: The Personal Security Checklist

#58

Post by Aachen » Mon, Apr 04, 2022, 10:48 AM UTC

yonixw wrote: post #47

Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> but not to keep would-be-two factors in one vault. So where? Having them physically spread around my house? in my PO BOX? Each have been cracked before, or are lost all the time (even by a simple fire). What can an average person do better than remember one strong password?

My recommendation for keeping second factor key material would be on a supported smartphone and make backups of that device (I use termux and restic but anything goes here, so long as your desktop can't get at the data). The app isolation makes it a lot harder to get at data compared to when malware makes it onto your desktop. Most people also don't have full control of their phone from their desktop and vice versa, making it independent devices where the compromise of one doesn't compromise the other - even if you have photo sync and remote wipe, you usually can't simply get app data.

I looked into different apps for a family member (I don't have a secure phone myself because I use the hardware longer than there are updates, so I don't use this personally) and the winner at the time, this was 2017 or so, was Keepass2Android. This is considering both usability and security, but mainly security - I'd probably not be able to teach my grandparents how to use this.

An alternative specifically for codes that you should never need is indeed something like a bank vault, or using Shamir's Secret Sharing Scheme to split it up and give one part to a friend in addition to your own share.

Re: The Personal Security Checklist

#59

Post by koprulusector » Mon, Apr 04, 2022, 10:48 AM UTC

robjan wrote: post #57

mr_mitm wrote: post #48

Earlier quoted context omitted.

A typical password manager is two factors: something you have (the password database) and something you know (the master password).

A typical password manager is BitWarden or LastPass which is on the cloud and only requires your master password.

My LastPass requires master password + yubikey

Re: The Personal Security Checklist

#60

Post by yonixw » Mon, Apr 04, 2022, 10:54 AM UTC

Aachen wrote: post #58

yonixw wrote: post #47

Earlier quoted context omitted.

> but not to keep would-be-two factors in one vault. So where? Having them physically spread around my house? in my PO BOX? Each have been cracked before, or are lost all the time (even by a simple fire). What can an average person do better than remember one strong password?

My recommendation for keeping second factor key material would be on a supported smartphone and make backups of that device (I use termux and restic but anything goes here, so long as your desktop can't get at the data). The app isolation makes it a lot harder to get at data compared to when malware makes it onto your desktop. Most people also don't have full control of their phone from their desktop and vice versa,…

But then, once a phone get lost, how do you recover those second factor keys? Or do you mean to have encrypted backup but the "active usage" is on another device? If so I agree and do the same.