Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to encrypt your entire life in less than an hour

medium.freecodecamp.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: How to encrypt your entire life in less than an hour

#61

Post by pbhjpbhj »

et-al wrote: post #27
mtgx wrote: post #8

Earlier quoted context omitted.

SMS 2FA isn't safe at least, and even NIST is deprecating it. The rest depends on dumb implementations, like Paypal allowing 2FA bypass with a change of the login link, or Google allowing 2FA bypass of all of its other methods by forcing you to use a phone number as "backup", which is to 2FA what secret questions were to passwords (their Achilles's heel).

Secret questions are horrible when they're predefined, and what's worse is when the options are also predefined (e.g. United Airline's website). However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world who know and I'm comfortable with that (of course this changes with the over-publicising of our lives on social media). But I'm digressing and agree TOTOP 2…

>However a secret question like "who did you have a crush on back in 5th grade" is limited to maybe 10 people the world //

Who quite possibly can be established from either your Facebook or your friends' Facebook (eg you have your friends list set private but a friend who posts on your wall doesn't).

Taking the "I had a crush on 'snail-fridge-running-spectrum'" line reduces the number who know the answer to on average less than 1(!).

Re: How to encrypt your entire life in less than an hour

#62

Post by EuAndreh »

madamelic wrote: post #50
EuAndreh wrote: post #49

> In a single sitting, you can make great strides toward securing your privacy. There's no such thing as privacy when using proprietary software. If the goal is to secure your privacy, there no need to argue beyond that.

That was my thought when he suggested using Signal. Sure it might be secure now but we have no clue if / when the app is infiltrated or even worse, could be spoofed and have a bad app pushed to our phones. (Don't hang me. Just off the cuff idea, I have no clue if it is completely possible to do such a thing but it seems within the realm of possibilities) EDIT: On second thought, don't you have to sign apps with a pri…

Of course, signing is another thing to consider.

However, when the author suggests using FileVault, it shows that he doesn't consider the implications of installing a proprietary software, or using a proprietary OS.

Re: How to encrypt your entire life in less than an hour

#63

Post by fgandiya »

darkhorn wrote: post #24

Be careful with 2 factot authentication. A Telegram user was hacked by the police in Russia. The government can receive your SMSes. Use non-SMS 2-factor.

What else can TFA fall back on. I know steam uses email and iOS tells you're other devices, but is there another option.

Re: How to encrypt your entire life in less than an hour

#64

Post by torrances »

nommm-nommm wrote: post #18
torrances wrote: post #14

I would also add another tip: create a separate email to use for financial accounts. Don't use this email for anything else.

Can you elaborate on why.

I would say it's similar to not using the same password on multiple sites.

If you use the same email, once that one is compromised, than all accounts related to it could be in jeopardy.

By having a separate account just for financial purposes, which isn't used for regular emails with anyone, it just decreases the chances of it being leaked.

Re: How to encrypt your entire life in less than an hour

#65

Post by matt_kantor »

fgandiya wrote: post #63
darkhorn wrote: post #24

Be careful with 2 factot authentication. A Telegram user was hacked by the police in Russia. The government can receive your SMSes. Use non-SMS 2-factor.

What else can TFA fall back on. I know steam uses email and iOS tells you're other devices, but is there another option.

TOTP[1] is a common one. I use the FreeOTP[2] Android app but there are plenty of other options.

[1]: https://en.wikipedia.org/wiki/Time-based_One-time_Password_A...

[2]: https://freeotp.github.io/

Re: How to encrypt your entire life in less than an hour

#66

Post by darkhorn »

fgandiya wrote: post #63
darkhorn wrote: post #24

Be careful with 2 factot authentication. A Telegram user was hacked by the police in Russia. The government can receive your SMSes. Use non-SMS 2-factor.

What else can TFA fall back on. I know steam uses email and iOS tells you're other devices, but is there another option.

* Pre-printed codes (like in Google)

* Trusted friends (like in Facebook)

* Renew your password in the office (like in my university)

* User-side SSL certificate

* Oh, end then Telegram introduced PIN+TFA

Re: How to encrypt your entire life in less than an hour

#67

Post by qutebird »

buildbot wrote: post #39
simonebrunozzi wrote: post #15

I am not 100% sold on one particular password manager. Any hints/suggestions?

I really enjoy how simple pass is : https://www.passwordstore.org/

I use pass too and love it, but it is worth noting that the names of the passwords are not encrypted, meta data based on the names can be extracted. The naming scheme is fully up to you though, but if you don't want to expose meta data at all, I'd recommend keepass instead.

Re: How to encrypt your entire life in less than an hour

#68

Post by Asooka »

tonyarkles wrote: post #42
Asooka wrote: post #38

Signal is atrocious for security. You literally log in with your phone number. Anything you send is directly and irrevocably tied with your physical identity. What good is to me that the messages are encrypted? When the police come knocking, either I'll decrypt them, they'll beat me until I decrypt them, or I'll die in prison for not decrypting them. I do want my messages encrypted, but more than that I really want t…

It's an interesting problem! There's a lot of pieces that are equally strong "personal identifiers" to a phone number, including your carrier tying your IP address to your IMSI. Add to that, if both parties of the communication are under surveillance, there's going to be strong time correlations. You're describing a very different use case than what I use Signal for (discussing things that could be harmful for client…

Mine was solved decades ago when I was allowed to just make an account with an e-mail and create any number of pseudonymous accounts. This allows me things like to have a personal and work account, and not leak information between different identities. And, most importantly, it lets me talk to someone without having first to reveal my real-world identity. With Signal, I have to already know that person and trust them with my phone number. It's not really state surveillance, it's the fact that what used to be private information I only shared with close friends now has to be public and told to every random person online I want to chat with. Just.. just let me make an account tied to an e-mail or to my google profile or anything but my phone number. The entire thing creeps me out.

Re: How to encrypt your entire life in less than an hour

#69

Post by nickpsecurity »

mcbits wrote: post #59
ThrustVectoring wrote: post #53

Earlier quoted context omitted.

Depends on your threat model, really.

If the threat model includes "the police come knocking" and "die in prison" then it's best to assume the phone can be traced back to the store and approximate time it was sold (potentially even the exact time and cash register), and surveillance videos will be searched.

On top of that, Target has the best video surveillance and most cooperation with police of any large retailer. Their surveillance group even spends a good chunk of its time doing work for various police departments who don't have resources to process the evidence themselves. One should never use a target for anything privacy-related if the police are in the threat model.

Re: How to encrypt your entire life in less than an hour

#70

Post by unhammer »

madamelic wrote: post #50
EuAndreh wrote: post #49

> In a single sitting, you can make great strides toward securing your privacy. There's no such thing as privacy when using proprietary software. If the goal is to secure your privacy, there no need to argue beyond that.

That was my thought when he suggested using Signal. Sure it might be secure now but we have no clue if / when the app is infiltrated or even worse, could be spoofed and have a bad app pushed to our phones. (Don't hang me. Just off the cuff idea, I have no clue if it is completely possible to do such a thing but it seems within the realm of possibilities) EDIT: On second thought, don't you have to sign apps with a pri…

Actually, Signal is one of the few apps where you can verify that the binary is produced by the source you have: https://whispersystems.org/blog/reproducible-android/
Post reply on HN