Have I been pwned? Check if your email has been compromised in a data breach • Hacker News Board

Re: Have I been pwned? Check if your email has been compromised in a data breach

#291

Post by bigiain » Fri, Dec 06, 2013, 12:38 AM UTC

Figs wrote: post #266

bigiain wrote: post #172

Earlier quoted context omitted.

For some logins, the answer is "Sorry Dave, I can't do that." If I don't have the private cert, or the ssh cert, or the right hole in the firewall - there are many thing I've chosen intentionally to not be able to log in to using someone else's computer. For lesser security critical logins, I've got my password software (1Password) on my phone (and iPad). For some intermediate level logins, I need my phone or iPad an…

What will you do if your primary computer gets stolen?

Private SSL/TLS certs, ssh keys, and 1Password database are all stored on encrypted fiesystems (EncFS) and synced across four machines (two at work, one at home, and my laptop) using Dropbox (which is another off-site copy, and has revision archives) and/or BTSync. Those four copies are all OS X Time Machine backed up (and revision archived) - and two of those Time Machine backups are rsynced nightly to separate drives in opposite locations - so all up (not couning Dropbox) I've got copies on 10 separate spindles in two physical locations, two of them in a locked filing cabinet (the work time machine and rsync disks).

I've had a "primary computer" stolen before – and I don't intend to ever have that much grief if (when?) it happens again. I'm confident that even if all the electronics from either one of my work or home get stolen, I could be back into fully productive work-mode in half a day and one maxed-out-creditcard at the local Apple store. (If someone hits both my work and home locations simultanously, I suspect I've got bigger problems that whether I'll have angry clients shouting at me before the weekend…)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#292

Post by bigiain » Fri, Dec 06, 2013, 12:48 AM UTC

Morgawr wrote: post #155

elwell wrote: post #88

Earlier quoted context omitted.

What do you do when you are using a different computer and need to login to site?

I use a yubikey that outputs half of the password used to unlock my keypass database, the other half is in my head (so even if they steal my yubi they can't do much). The database is backed on my own owncloud which is hosted on my own vps and replicated on other 3-4 servers (all mine). My little personal cloud setup. Call me paranoid but it took me half an hour to set it up and the monthly fees for the servers are ve…

" … hosted on my own vps … "

Might want to think through whether that really counts as "your own". Who's got hypervisor access to the hardware? Any keys or passphrases that ever hit the disk or memory on someone else's hardware should (at least at some levels of paranoia) be considered "possibly compromised".

(I store "sensitive stuff" on AWS/DigitalOcean/other-vps-providers, but only if it's first encrypted locally and the key/passphrase never gets used/stored on the vps. EncFS works pretty well dealing with that for me... I do, though, "trust" 1Passwords datafile encryption enough to take advantage of the iOS/MacOSX sync features they've implemented over Dropbox. That's possibly not achoice I'd make i I thought I were a target of someone like the NSA.)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#293

Post by Twirrim » Fri, Dec 06, 2013, 2:41 AM UTC

aragot wrote: post #204

da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

... Aren't password manager the #1 target for hackers nowadays? Imagine how much that wallet could be worth... How much bribe does the weakest 1Password engineer need?

Then use a local storage one, like password-safe (Win & Mac. password-gorilla for Linux). Combine that with spideroak, dropbox, google drive or whatever file syncing utility you want.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#294

Post by ScrawlingChaos » Wed, Dec 11, 2013, 4:06 PM UTC

Weird. Flagged a hotmail addy I rarely use as having been compromised in the Adobe breach, but I don't recall ever using that address with Adobe and when I plug it into Adobe to reset the password for it, it says that they have no account associated with that address.