Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Personal Security Checklist

github.com

Post reply on HN
Print view View original

71–80 of 116 posts

Re: The Personal Security Checklist

#71

Post by jamesmishra »

blfr wrote: post #41
PennRobotics wrote: post #38

There's an obvious tradeoff having an authenticator (2FA/OTP) separate from your secure password manager. If you lose the device with credentials, you're screwed. It's really easy to lose access to a device (and usually without advance notice). Or you can override the 2FA, and then you're back to hoping the verification procedure of overriding 2FA is stronger than a dedicated attacker. A password manager managing 10…

> Maybe the best strategy is a hardware key with printed backup code? Or register more than one (preferably three) hardware key. It sidesteps all of these issues. They are very resilient and act as backups.

But then where do you put the hardware keys?

Presumably you would need to obtain all three keys every time you register a new user account on a website.

Re: The Personal Security Checklist

#72

Post by yonixw »

dividedbyzero wrote: post #69
RealStickman_ wrote: post #61

Earlier quoted context omitted.

I keep my recovery keys encrypted with a different password on my desktop. You could also export the 2FA codes from some apps.

Where do you keep that password? Rarely-used ones are easy to forget after all.

I love this comment and this thread. It is literally what happens in my head every time I need to sign up to a new site (having an existential security crisis). Good to see I'm not the only one!

Re: The Personal Security Checklist

#73

Post by Aachen »

yonixw wrote: post #72
dividedbyzero wrote: post #69

Earlier quoted context omitted.

Where do you keep that password? Rarely-used ones are easy to forget after all.

I love this comment and this thread. It is literally what happens in my head every time I need to sign up to a new site (having an existential security crisis). Good to see I'm not the only one!

Yeah it's definitely a valid concern, though the considerations for different solutions are a bit too elaborate for me to type out on mobile atm. Some ideas

- regularly testing backups also ensures you still have the key material

- Shamir's Secret Sharing Scheme, in combination with putting it on paper or multiple devices or...

- bank/company vault

- hardware security token

- give the master keys to the company's master (some tech director) and make it someone else's problem, if you want to be evil :)

Re: The Personal Security Checklist

#75

Post by euphetar »

pseudobry wrote: post #3

I'm glad I saw this, it looks like an excellent resource. However, I can't help but feel a bit of despair while looking at it. There is so much stuff to do / know about, that it's incredibly far beyond what the average person could understand, let alone follow. Most people won't get close. I'm capable of doing everything described (and I follow a good chunk of it), but I have hundreds of accounts. The shear effort re…

This so much. It's good its all in one place, but come on, it's a checklist of four whole screens.

I would prefer a minimal checklist instead: what measures give you the most (security) bang per buck (effort spent)?

Re: The Personal Security Checklist

#76

Post by FabHK »

leavenotracks wrote: post #62
FabHK wrote: post #36

Earlier quoted context omitted.

So, yes.

Individual words then are easily crackable. But, take 3 long dictionary words chained together...easier to remember and more secure than a shorter randomly generated string. E.g. postcriptaluminumengagement vs kug45l2wx Or are there also dictionaries that contain combos of words?! (Would be rather a large dictionary).

> E.g. postcriptaluminumengagement vs kug45l2wx

If you pick from a dictionary of 250,000 words, that is around 18 bits. So three randomly chosen words strung together give you around 54 bits. On the other hand, an alphanumeric character is around 6 bits, so 9 of them strung together is about 54 bits.

Assuming your dictionary was 250,000 words, both of the passwords you posted were about the same quality (until you posted them - now they're again about the same quality, but much less).

> Or are there also dictionaries that contain combos of words?!

Your software just concatenates words and other well known sequences (123, zxcvbn).

Check out the great password entropy checker called zxcvbn:

https://github.com/dropbox/zxcvbn

https://dropbox.tech/security/zxcvbn-realistic-password-stre...

https://www.bennish.net/password-strength-checker/

(Note: don't enter production passwords into random websites, needless to say...)

Re: The Personal Security Checklist

#77

Post by rinze »

robjan wrote: post #57
mr_mitm wrote: post #48

Earlier quoted context omitted.

A typical password manager is two factors: something you have (the password database) and something you know (the master password).

A typical password manager is BitWarden or LastPass which is on the cloud and only requires your master password.

Precisely because of that I use a different solution: Dropbox + KeePassXC. If someone wants to access my passwords, they first have to get into my Dropbox account, then get the password to the KeePass file. At this point that level of security is good enough for me.

Edit: typos.

Re: The Personal Security Checklist

#78

Post by DennisP »

yonixw wrote: post #47
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> but not to keep would-be-two factors in one vault. So where? Having them physically spread around my house? in my PO BOX? Each have been cracked before, or are lost all the time (even by a simple fire). What can an average person do better than remember one strong password?

Yes, stored at your house is fine for most people. There's a big security jump between "needing your password" and "needing your password plus having to steal something from your house."

There's also a big jump between "stealing something from your house" and "stealing something from your house plus figuring out your password."

Re: The Personal Security Checklist

#80

Post by westurner »

Also good: "The SaaS CTO Security Checklist [Redux]" https://github.com/vikrum/SecurityChecklists

"The Personal Infosec & Security Checklist" https://www.goldfiglabs.com/guide/personal-infosec-security-...

"The DevOps Security Checklist Redux" https://www.goldfiglabs.com/guide/devops-security-checklist/

... Years ago, I helped develop a checklist app for a hospital (in Python and JS at the time).

TIL checklists usually are justified, and may be the only process for collaboratively improving process controls that a healthy organization handling feedback has established; who gets to send PRs to the checklist, and what criteria should be applied such that evidence-based variations of process are objectively tested?

"Post-surgical deaths in Scotland drop by a third, attributed to a checklist" (2019) https://news.ycombinator.com/item?id=19684376

Post reply on HN