Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Personal Security Checklist

github.com

Post reply on HN
Print view View original

91–100 of 116 posts

Re: The Personal Security Checklist

#91

Post by DennisP »

dividedbyzero wrote: post #85
DennisP wrote: post #78

Earlier quoted context omitted.

Yes, stored at your house is fine for most people. There's a big security jump between "needing your password" and "needing your password plus having to steal something from your house." There's also a big jump between "stealing something from your house" and "stealing something from your house plus figuring out your password."

That makes it impossible to get into your email if you use your phone on vacation, though.

A decent tradeoff for that case is to use your phone as the "something you have," with backup codes stored somewhere reasonably secure.

Re: The Personal Security Checklist

#92

Post by digitallyfree »

dividedbyzero wrote: post #66
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> Aaand we're down to single-factor authentication We're not, not really. The only single password that can unlock 2FA is that for the password manager, but most phishing attacks I'm aware of target the specific services, not password managers, since it's usually way easier to fake a banking login. Good password managers will have dedicated apps, so entering that password on some janky website is not something victim…

I keep multiple password manager "vaults" (with Keepass) for multiple services. All of them have long passwords. Every morning, I will recall the passwords in my head to make sure I remember them, and on a schedule I'll log into the rarely used vaults just to ensure that access is working properly. The same goes for the passwords that I keep in memory as well (for email etc. where I may need to use a public computer in a emergency without my password manager or personal device available), bank PIN, important phone numbers, and so on.

The idea is to recall the passwords so often (many times daily to start, then daily when it's stuck in your mind) so that you can do it in any circumstance while under stress. Of course this doesn't excuse the need for a secure backup of those crucial passwords somewhere, but at least the chance of forgetting them is next to none.

Re: The Personal Security Checklist

#93

Post by CalChris »

loevborg wrote: post #54
CalChris wrote: post #8

With respect to password managers, it doesn't mention Apple's iCloud Keychain. Any reason why?

You can't use it with Chrome, so you're locked into Safari forever.

Apple released their iCloud Passwords extension [1] for Chrome last November.

I actually moved away from Chrome to Safari when I migrated over to my new m1. It's actually pretty good. The one caveat is Google's Advanced Protection Program only works with Chrome. The article doesn't cover that as well.

[1] https://loginlockdown.com/reviews/icloud-keychain/

Re: The Personal Security Checklist

#94

Post by zrail »

kdtsh wrote: post #27
astockwell wrote: post #20

Earlier quoted context omitted.

If you press and hold both the lock button + the volume up button long enough to open the power-off screen, it will disable faceID (on iPhone) until you enter your passcode again. Handy to know and easy enough to do discreetly in a pinch.

Pressing the power button five times in quick succession does the same - another handy trick.

On my phone pressing the power button five times quickly starts a 10 second timer and then it auto-calls emergency services and I'm pretty sure this is the default.

Re: The Personal Security Checklist

#96

Post by aendruk »

Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

Pull request: https://github.com/Lissy93/personal-security-checklist/issue...

Re: The Personal Security Checklist

#97

Post by hda111 »

timwis wrote: post #86
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> Aaand we're down to single-factor authentication Not necessarily: if your password manager requires more than one factor to access, then there's still no way to access the service with only one factor. This might be standard MFA to login to your password vault, or in the case of 1Password, the vault's encryption key _basically_ serves as a second factor, so long as you never save it digitally (and print it instead)…

Agreed. The second factor is merely a protection to login on untrusted browsers. And you probably don’t install your password manager there.

Re: The Personal Security Checklist

#98

Post by dividedbyzero »

lbriner wrote: post #81
dividedbyzero wrote: post #66

Earlier quoted context omitted.

> Aaand we're down to single-factor authentication We're not, not really. The only single password that can unlock 2FA is that for the password manager, but most phishing attacks I'm aware of target the specific services, not password managers, since it's usually way easier to fake a banking login. Good password managers will have dedicated apps, so entering that password on some janky website is not something victim…

> We're not, not really. We are, by definition down to single factor if you store the codes in the password vault. The argument wasn't that therefore the system is weak, it is just that the point of having a second/third factor is to add something that isn't already present in an attack against a system. One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to…

> We are, by definition down to single factor if you store the codes in the password vault.

Agreed, I should have worded that differently, that was just asking for someone to nitpick. But I don't think that detracts from my wider point.

> One example would be that you leave your desk momentarily with your password vault unlocked and someone decides to quickly use your account to login to some system.

TFA is talking about personal security, which I read as "private life security", not "workplace security for a software engineer on their work laptop in a semi-public space". That would be a much more high-value target with a very different threat landscape that warrants more effort to be spent on security (supported by security teams, on paid time, and having above-average security expertise).

Re: The Personal Security Checklist

#100

Post by remus »

digitallyfree wrote: post #92
dividedbyzero wrote: post #66

Earlier quoted context omitted.

> Aaand we're down to single-factor authentication We're not, not really. The only single password that can unlock 2FA is that for the password manager, but most phishing attacks I'm aware of target the specific services, not password managers, since it's usually way easier to fake a banking login. Good password managers will have dedicated apps, so entering that password on some janky website is not something victim…

I keep multiple password manager "vaults" (with Keepass) for multiple services. All of them have long passwords. Every morning, I will recall the passwords in my head to make sure I remember them, and on a schedule I'll log into the rarely used vaults just to ensure that access is working properly. The same goes for the passwords that I keep in memory as well (for email etc. where I may need to use a public computer…

> Of course this doesn't excuse the need for a secure backup of those crucial passwords somewhere

Sounds like you need a password manager manager!

Post reply on HN