Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Protecting Secrets from Computers (2023)

dl.acm.org

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Protecting Secrets from Computers (2023)

#21

Post by sirsuki »

hairyplanner wrote: post #12

My biggest challenge as I’m getting older is remembering my long secret key. Even with a password manager that requires me to remember only a few passphrases (personal and work being two), there is a non zero chance now that a fall and a concussion would lock me out of my password manager. Anyone else have a solution or a suggestion for this problem?

Yes. Place the secrets in a secured (symmetric encrypted) document. Then print the password for that document and hand it to a loved one, trusted family member/friend, or lawyer.

Re: Protecting Secrets from Computers (2023)

#22

Post by Klaus23 »

bandie91 wrote: post #17
Klaus23 wrote: post #16

Is there a good pen-and-paper OTP authentication mechanism?

otpw PAM module does this. https://manpages.debian.org/buster/libpam-otpw/pam_otpw.8.en...

I was talking about a point discussed in the article. There is an attack on OTP because the attacker can change the message if there is no hash-like authentication of the message's correctness. I asked if there was a pen-and-paper way to authenticate an OTP message.

Re: Protecting Secrets from Computers (2023)

#23

Post by couchand »

kilmanio wrote: post #18
Vecr wrote: post #14

Earlier quoted context omitted.

Wear a helmet and hip pads, but failing that split the password in half (as in literally the first half and the second half, don't try to get fancy with crypto) and give the halves to two people unlikely to collude. Your computer will no longer have 5th amendment protection, though.

Or better, use `Shamir's Secret Sharing` https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing

GP specifically called out, "don't try to get fancy with crypto" and I'm inclined to agree with them for this use case.

Re: Protecting Secrets from Computers (2023)

#24

Post by Loic »

hairyplanner wrote: post #12

My biggest challenge as I’m getting older is remembering my long secret key. Even with a password manager that requires me to remember only a few passphrases (personal and work being two), there is a non zero chance now that a fall and a concussion would lock me out of my password manager. Anyone else have a solution or a suggestion for this problem?

My wife has my passphrases in her password manager and I have her passphrase in my password manager.

This is maybe not the most secure way to do it, but this is good enough for our threat model.

These are offline password managers.

Re: Protecting Secrets from Computers (2023)

#25

Post by JackSlateur »

hairyplanner wrote: post #12

My biggest challenge as I’m getting older is remembering my long secret key. Even with a password manager that requires me to remember only a few passphrases (personal and work being two), there is a non zero chance now that a fall and a concussion would lock me out of my password manager. Anyone else have a solution or a suggestion for this problem?

Use the good old post-it method

Remember poe : what's hidden in plain sight is never found (and nobody is looking anyway)

Re: Protecting Secrets from Computers (2023)

#26

Post by pclmulqdq »

hairyplanner wrote: post #12

My biggest challenge as I’m getting older is remembering my long secret key. Even with a password manager that requires me to remember only a few passphrases (personal and work being two), there is a non zero chance now that a fall and a concussion would lock me out of my password manager. Anyone else have a solution or a suggestion for this problem?

Shamir's secret sharing with 3 separate lawyers is kind of hard to beat if you have cryptocurrency or other similar assets that absolutely need a password to recover it, and it is a relatively easy algorithm to run. Give them the same instruction sheet on how to run the algorithm, plus a different second page with their fragment of the key.

Most of the time, though, the "call us" approach actually works, and you can give your relatives power of attorney to handle this.

Re: Protecting Secrets from Computers (2023)

#27

Post by Logans_Run »

* Pricing

Pricing and access depends on your membership or subscriptions with ACM. Purchase this Article Purchase this Article: Protecting Secrets from Computers Terence Kelly

    Purchase Article
    Purchase Article
    Non Member$15.00
    ACM Professional Member$10.00
    ACM Student Member$5.00

    Already an acm Member? Sign In or become a member
deepdyve logo Available at DeepDyve

The Largest Online Rental Service for Scholarly Research

Price: $0.00 *

I.A. or similar link kindly requested please. TYIA

Re: Protecting Secrets from Computers (2023)

#28

Post by knowaveragejoe »

Logans_Run wrote: post #27

* Pricing Pricing and access depends on your membership or subscriptions with ACM. Purchase this Article Purchase this Article: Protecting Secrets from Computers Terence Kelly Purchase Article Purchase Article Non Member$15.00 ACM Professional Member$10.00 ACM Student Member$5.00 Already an acm Member? Sign In or become a member deepdyve logo Available at DeepDyve The Largest Online Rental Service for Scholarly Resea…

All you have to do is click "all formats" and select one.

https://queue.acm.org/detail.cfm?id=3623614&doi=10.1145%2F36...

Post reply on HN