Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Personal Security Checklist

github.com

Post reply on HN
Print view View original

101–110 of 116 posts

Re: The Personal Security Checklist

#101

Post by nopcode »

TacticalCoder wrote: post #89
yonixw wrote: post #47

Earlier quoted context omitted.

> but not to keep would-be-two factors in one vault. So where? Having them physically spread around my house? in my PO BOX? Each have been cracked before, or are lost all the time (even by a simple fire). What can an average person do better than remember one strong password?

> What can an average person do better than remember one strong password? Use as 2FA a physical U2F device which is itself protect by an HSM and a PIN and erases itself after 3 failed attempts (which, granted, comes with its own problem if you lose it / forget your PIN / have it stolen). It's kinda a big fraud that Yubikeys have been "sold" as the be-all / end-all of 2FA when they are, themselves, not protected by a…

Threat is not the only factor. The control (entering a PIN) has a cost (it's tiresome) and only a certain risk reduction value (if they can steal my key, they can probably steal my PIN).

Re: The Personal Security Checklist

#102

Post by Aachen »

timwis wrote: post #86
Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> Aaand we're down to single-factor authentication Not necessarily: if your password manager requires more than one factor to access, then there's still no way to access the service with only one factor. This might be standard MFA to login to your password vault, or in the case of 1Password, the vault's encryption key _basically_ serves as a second factor, so long as you never save it digitally (and print it instead)…

Someone else posted the same remark 4 hours before you, one comment down. To not repeat the same conversation, please refer to there: https://news.ycombinator.com/item?id=30904892

Re: The Personal Security Checklist

#104

Post by egberts1 »

kube-system wrote: post #99

I don't understand why anyone recommends disabling javascript. If you're making that much of a sacrifice in user experience, you might as well uninstall your web browser.

because malicious JS are abound!

and it is going to get worse with the advent of WASM rollouts.

Re: The Personal Security Checklist

#105

Post by freemint »

Aachen wrote: post #64
leavenotracks wrote: post #62

Earlier quoted context omitted.

Individual words then are easily crackable. But, take 3 long dictionary words chained together...easier to remember and more secure than a shorter randomly generated string. E.g. postcriptaluminumengagement vs kug45l2wx Or are there also dictionaries that contain combos of words?! (Would be rather a large dictionary).

3 words is not enough usually, but it technically depends on the dictionary size. Since the formula is dictsize^numwords, adding a word to your phrases is a lot better than adding a thousand words to your dictionary (also because of diminishing returns above ~5 thousand words). Iirc 6 words is a good size for most dictionaries or 7 words for diceware, but might be off by one so please look around. I remember posting…

Why are you assuming the advesary knows what dictionary is being used?

Re: The Personal Security Checklist

#106

Post by digitallyfree »

remus wrote: post #100
digitallyfree wrote: post #92

Earlier quoted context omitted.

I keep multiple password manager "vaults" (with Keepass) for multiple services. All of them have long passwords. Every morning, I will recall the passwords in my head to make sure I remember them, and on a schedule I'll log into the rarely used vaults just to ensure that access is working properly. The same goes for the passwords that I keep in memory as well (for email etc. where I may need to use a public computer…

> Of course this doesn't excuse the need for a secure backup of those crucial passwords somewhere Sounds like you need a password manager manager!

Yeah I use Keepass to store those as well.

Re: The Personal Security Checklist

#107

Post by aborsy »

Good question: CEOs, executives, members of parliaments, journalists, researchers at industrial labs, those working in defense/military/aerospace, etc are at elevated risk of being hacked by governments and hacking companies such as NSO.

Are there guidelines how should these individuals protect themselves against such powerful adversaries?

Like if you work for the German or Chinese government in an important capacity, or lead a major company there, it’s a question whether you should use an iPhone (given that it’s a black box made by a US company), cloud services, etc.

How about if both sides are within the same country? For example, is a Google executive using an iPhone at risk of being spied on by Apple?

Re: The Personal Security Checklist

#108

Post by i13e »

Aachen wrote: post #33

> You could store [2fa backup codes] in your password manager Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager. I do recommend a password manager, but not to keep would-be-two factors in one vault. Also the very first item in the guide makes a blanket statement about dictionary words being really crackable. I forgave that one…

> Aaand we're down to single-factor authentication: your password from your password manager plus your backup codes from your password manager.

Couldn't you store your 2FA codes and passwords and backups (theoretically everything) in a password manager (ex. bitwarden), encrypted, salted, hashed and all of that with a strong and complicated password AND hardware 2FA (ex. yubikey) and be better off than separating it out? All of your data is extremely secure, can be managed in one place, and you aren't gonna lose your 2FA codes if your phone randomly breaks. I think for the average user this strategy is the best middle ground for security and simplicity

Re: The Personal Security Checklist

#109

Post by h4waii »

leavenotracks wrote: post #62
FabHK wrote: post #36

Earlier quoted context omitted.

So, yes.

Individual words then are easily crackable. But, take 3 long dictionary words chained together...easier to remember and more secure than a shorter randomly generated string. E.g. postcriptaluminumengagement vs kug45l2wx Or are there also dictionaries that contain combos of words?! (Would be rather a large dictionary).

Gone are the days of huge generic dictionaries, a small tailored dictionary with a proper ruleset will pick off 3 word phrases with ease.

Re: The Personal Security Checklist

#110

Post by Aachen »

freemint wrote: post #105
Aachen wrote: post #64

Earlier quoted context omitted.

3 words is not enough usually, but it technically depends on the dictionary size. Since the formula is dictsize^numwords, adding a word to your phrases is a lot better than adding a thousand words to your dictionary (also because of diminishing returns above ~5 thousand words). Iirc 6 words is a good size for most dictionaries or 7 words for diceware, but might be off by one so please look around. I remember posting…

Why are you assuming the advesary knows what dictionary is being used?

Because there are only so many words in the world and an English person isn't going to use a Dutch dictionary. At that point it's going to be harder to remember than just random characters of the same entropy.
Post reply on HN