Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Personal Security Checklist

github.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: The Personal Security Checklist

#81

Post by lbriner »

dividedbyzero wrote: post #66
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> Aaand we're down to single-factor authentication We're not, not really. The only single password that can unlock 2FA is that for the password manager, but most phishing attacks I'm aware of target the specific services, not password managers, since it's usually way easier to fake a banking login. Good password managers will have dedicated apps, so entering that password on some janky website is not something victim…

> We're not, not really.

We are, by definition down to single factor if you store the codes in the password vault. The argument wasn't that therefore the system is weak, it is just that the point of having a second/third factor is to add something that isn't already present in an attack against a system.

One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system. Single point of failure. If you had the codes on a cellphone instead, firstly there is more of a chance that you would have taken your phone with you but even if you didn't, that "attack" now needs to access your phone as well.

Not all attacks are strangers and not all are malicious, just somebody elevating their privileges via your status is an attack in the broadest sense, even if they did it for respectable reasons.

Re: The Personal Security Checklist

#82

Post by crispyambulance »

leavenotracks wrote: post #63
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

Despite its shortcomings, I value the attempt to generate this list and thank the author for it. Moreover, it's on Github so issues and pull-requests can be created, and the list can be improved. Even though a ot of the advice will be sound for pretty much all-time, unless this kind of list is maintained in this way it would grow very stale very quickly.

Yeah, I would expect a smug, persnickety dismissal from HN folks. But it's largely GOOD advice and we need more of this kind of thing going around.

When trying to find advice for personal cyber security by googling around, you get a wild range of material ranging from simplistic listicles, to paranoiac rantings, to BS marketing slick from entities trying to sell stuff. It's hard to find solid advice with actual reasoning behind it.

Would a normal person (who is not a target for nation-state actors) be in very good shape, cyber-security-wise, if they followed the "recommended" advice in that checklist? I say yes-- even if they put their 2FA backup codes in their password manager!

Re: The Personal Security Checklist

#83

Post by Terretta »

alipitch wrote: post #18

Is there a list issued by eff.org, nist or a similar organization, that is maintained and updated?

> This guide is an overview of digital security considerations specific to journalists covering protests. For EFF’s comprehensive guide to digital security, including advice for activists and protesters, visit ssd.eff.org. Legal advice in this post is specific to the United States.

https://www.eff.org/nb/deeplinks/2020/06/digital-security-ad...

Also:

SURVEILLANCE SELF-DEFENSE: TIPS, TOOLS AND HOW-TOS FOR SAFER ONLINE COMMUNICATIONS -- A PROJECT OF THE ELECTRONIC FRONTIER FOUNDATION

https://ssd.eff.org

Re: The Personal Security Checklist

#84

Post by dividedbyzero »

Aachen wrote: post #73
yonixw wrote: post #72

Earlier quoted context omitted.

I love this comment and this thread. It is literally what happens in my head every time I need to sign up to a new site (having an existential security crisis). Good to see I'm not the only one!

Yeah it's definitely a valid concern, though the considerations for different solutions are a bit too elaborate for me to type out on mobile atm. Some ideas - regularly testing backups also ensures you still have the key material - Shamir's Secret Sharing Scheme, in combination with putting it on paper or multiple devices or... - bank/company vault - hardware security token - give the master keys to the company's mas…

I thought we were discussing personal (i.e. non-work) security? At least that's what TFA appears to be about. Besides, Shamir's Secret Sharing can be outright dangerous even for companies, I really wouldn't recommend that to any private person.

Re: The Personal Security Checklist

#85

Post by dividedbyzero »

DennisP wrote: post #78
yonixw wrote: post #47

Earlier quoted context omitted.

> but not to keep would-be-two factors in one vault. So where? Having them physically spread around my house? in my PO BOX? Each have been cracked before, or are lost all the time (even by a simple fire). What can an average person do better than remember one strong password?

Yes, stored at your house is fine for most people. There's a big security jump between "needing your password" and "needing your password plus having to steal something from your house." There's also a big jump between "stealing something from your house" and "stealing something from your house plus figuring out your password."

That makes it impossible to get into your email if you use your phone on vacation, though.

Re: The Personal Security Checklist

#86

Post by timwis »

Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> Aaand we're down to single-factor authentication

Not necessarily: if your password manager requires more than one factor to access, then there's still no way to access the service with only one factor.

This might be standard MFA to login to your password vault, or in the case of 1Password, the vault's encryption key _basically_ serves as a second factor, so long as you never save it digitally (and print it instead).

Re: The Personal Security Checklist

#87

Post by SahAssar »

_wldu wrote: post #45
gorgoiler wrote: post #12

This doesn’t talk about real world adversaries, only hypothetical countermeasures. It would be more useful to know how I’m likely to be attacked, not how to protect against every threat the author could possibly think of. For example, I want to know where the villains actually go when they want to dox someone. Then I can dox myself and do something about it. I have no idea where to start and wouldn’t want to pay mone…

Assuming you are a US citizen, you likely have no need to worry about FVEY [1] targeting you unless a judge has been convinced you are a very bad person and issues a warrant. You do have to protect against cyber-criminals and potentially other nation state actors like Russia, China, Iran and North Korea. These groups do not control infrastructure (like FVEY) and have a harder time targeting you. BTW, this is why FVEY…

> Assuming you are a US citizen, you likely have no need to worry about FVEY [1] targeting you unless a judge has been convinced you are a very bad person and issues a warrant.

IIRC part of the snowden leaks was that US intelligence agencies used data gathered about US citizens by GCHQ (and the other five eyes members) and occasionally asked for more targeted gathering. I don't think it's as easy or straightforward as you make it out to be.

Re: The Personal Security Checklist

#88

Post by SahAssar »

Thorentis wrote: post #55
ravenstine wrote: post #53

> Don't reuse Passwords Nice in theory, and perhaps in practice if one uses a password manager that's unified across devices. In my opinion, password managers are a ticking time bomb. With maybe the exception of something like Firefox's built in password management, it's only a matter of time before these for-profit password managers are subject to significant exploits or data leaks. With strong 2FA, the necessity of…

KeePassXC is the exception to this. It is open source, and doesn't rely on another service (you can just put the file in Dropbox or something). Anybody who is seriously about security should be using it.

pass/gopass is basically the same.

Re: The Personal Security Checklist

#89

Post by TacticalCoder »

yonixw wrote: post #47
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> but not to keep would-be-two factors in one vault. So where? Having them physically spread around my house? in my PO BOX? Each have been cracked before, or are lost all the time (even by a simple fire). What can an average person do better than remember one strong password?

> What can an average person do better than remember one strong password?

Use as 2FA a physical U2F device which is itself protect by an HSM and a PIN and erases itself after 3 failed attempts (which, granted, comes with its own problem if you lose it / forget your PIN / have it stolen).

It's kinda a big fraud that Yubikeys have been "sold" as the be-all / end-all of 2FA when they are, themselves, not protected by a PIN (for costs reasons and costs reasons alone: there's no way on earth a pinless Yubikey is better than a U2F device protected by a HSM+PIN, but that costs way more to build). And here you'll get the ultimate argument: "you have to understand the threat model" / "this is not the threat model a Yubikey defends you again" etc. Oh really? Then why then do we have now Yubikey protected by fingerprints? The threat model changed or what?

Re: The Personal Security Checklist

#90

Post by Hnrobert42 »

godmode2019 wrote: post #24
Hnrobert42 wrote: post #2

The flaw with this list is that it treats all risks as equally likely and does not distinguish between various threat landscapes. Few people are high value enough to merit the effort required to capture a face from CCTV, generate a mask from the image, get physical access to their device, and use the mask to unlock. So for almost everyone, faceid is fine.

You are missing the legal distinction forcing a password from someone is illegal because of the right to remain silent. But detaining someone and scanning their face is 100% allowed.

Your point only underscores my point. The list doesn’t discuss your threat, so in my initial assessment of the list, I didn’t think of it.
Post reply on HN