Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So I lost my OpenBSD FDE password (2016)

words.filippo.io

Post reply on HN
Print view View original

61–70 of 77 posts

Re: So I lost my OpenBSD FDE password (2016)

#61

Post by dspillett »

colechristensen wrote: post #9
dspillett wrote: post #2

This is something that is difficult when trying to encourage less technical users to be secure. Once you convince them to do things right, they've heard of circumstances like this and are petrified of accidentally losing something. In a commercial environment there are ways and means¹ but getting a non-technical user to securely and safely manage access credentials is can be a time consuming education process. Especi…

>trying to encourage less technical users to be secure The threat of “losing the keys to all the data” is considerably larger than the threat of having your computer and data stolen for an average home user. It can’t just be a matter of more secure is better… you have to have an idea of what you’re trying to prevent. All of our shit has been lost in one leak or another so at this point it seems like it barely matters…

This is the other side of the problem: the issue is wider than your data and doesn't even need to be about FDE or other encryption. Simply using decent passwords/passphrases more generally is a hurdle to jump before even considering FDE because the other set of risks are when a bot gains access to the machine by those means it may be able to gain access to information to enable identity fraud or even get direct access to banking information (most care a lot more when their money is at stake than just their data or reputation). The circumstance in this post may not seem relevant here to us, but to a non-technical user the two are easily conflated (“I heard about someone who used a strong password and lost access to everything when it was forgotten”).

Re: So I lost my OpenBSD FDE password (2016)

#62

Post by raverbashing »

sedatk wrote: post #37

This is one the main problems with our approach to information security: we disproportionately prioritize protection of our data against theft/law enforcement/rogue bigtech employee over losing it in any other way. That's why many have lost their thousands of bitcoins, because they secured their keys so hard against theft that their data has eventually become unrecoverable despite that there'd be no thief, officer, r…

> "with our approach to information security"

Yeah, especially here on HN you hear about people not thinking about threat models. And yes, Denial-of-service by forgetting the password or having it inaccessible is a threat model

That's why I just laugh at the people who think putting everything in a password manager is the best way. It is good, but you need to understand your cases/threats and risks

Sometimes writing it in a piece of paper is the best solution

Re: So I lost my OpenBSD FDE password (2016)

#63

Post by kstenerud »

This is a big reason why I don't use full-disk encryption; I simply have no threat model that would warrant the risk of using it.

FDE doesn't protect against remote attacks, and anyone who would physically make off with my devices (a VERY unlikely event) is either:

* A thief who will turn around and sell them to someone who will erase them.

* A state actor who will get the data no matter what I do (and find it of no interest anyway).

Re: So I lost my OpenBSD FDE password (2016)

#64

Post by 2b3a51 »

ok_dad wrote: post #38

I’ve just been using the same password for my FDE forever, and only for that purpose. I figure it keeps my data safe from theft, but probably not from the feds or my wife if she wanted in there, because they could either compel me to unlock it or have access to put some keyboard sniffer in my boot loader. The password is quite a few random characters that I memorized when I first used FDE decades ago and I’ve never h…

battery horse stapler in a playfair grid?

https://en.wikipedia.org/wiki/Playfair_cipher

Not the full cypher but just reading out the letters in the grid in a different direction.

Re: So I lost my OpenBSD FDE password (2016)

#65

Post by TeMPOraL »

dspillett wrote: post #34
briHass wrote: post #18

Earlier quoted context omitted.

This is why Microsoft Windows is so adamant about having you create an online account as your means of sign-in on modern Windows versions. FDE requires it on some versions. Telling users that forgot their password that not only do they need to reinstall Windows, but that every single document, photo, video of their grandkids, etc. is now lost forever is untenable. At the same time, FDE is important for security, so w…

Well, one if the official reasons/excuses. Tracking in various forms is the main reason MS is so adamant about that…

The most effective kind of abuse is when the abuser has something genuine to offer to convince the other party to stay in an otherwise detrimental relationship.

Re: So I lost my OpenBSD FDE password (2016)

#66

Post by dist1ll »

TeMPOraL wrote: post #57
NoPicklez wrote: post #45

Earlier quoted context omitted.

Having encrypted data I wouldn't say is disproportionately prioritising protection over losing it in another way. The person simply forget what was a long password, something that most security conscious people would have figured out by storing it in a password vault. However I do agree that "going alone" with security can make us the victim of our own fragility. I can see this happening in the new blockchain world o…

> something that most security conscious people would have figured out by storing it in a password vault. Whatever that is if not another system protected by long password you're likely to lose, or that might bitrot past the point of recovery.

Any security-conscious person backs up their password manager.

Re: So I lost my OpenBSD FDE password (2016)

#67

Post by TeMPOraL »

dist1ll wrote: post #66
TeMPOraL wrote: post #57

Earlier quoted context omitted.

> something that most security conscious people would have figured out by storing it in a password vault. Whatever that is if not another system protected by long password you're likely to lose, or that might bitrot past the point of recovery.

Any security-conscious person backs up their password manager.

A lot of things get done asymptotically close to the True Scotsman singularity.

Re: So I lost my OpenBSD FDE password (2016)

#68

Post by ghaff »

raverbashing wrote: post #62
sedatk wrote: post #37

This is one the main problems with our approach to information security: we disproportionately prioritize protection of our data against theft/law enforcement/rogue bigtech employee over losing it in any other way. That's why many have lost their thousands of bitcoins, because they secured their keys so hard against theft that their data has eventually become unrecoverable despite that there'd be no thief, officer, r…

> "with our approach to information security" Yeah, especially here on HN you hear about people not thinking about threat models. And yes, Denial-of-service by forgetting the password or having it inaccessible is a threat model That's why I just laugh at the people who think putting everything in a password manager is the best way. It is good, but you need to understand your cases/threats and risks Sometimes writing…

Writing passwords on a sticky note on the bottom of your keyboard in an office is obviously a bad practice. A unique string password on a piece of paper in a drawer at home only you would normally have access to? Not clear. And obviously you can hide things in a house more thoroughly than that with the risk that you get too clever.

Re: So I lost my OpenBSD FDE password (2016)

#69

Post by maccard »

dist1ll wrote: post #66
TeMPOraL wrote: post #57

Earlier quoted context omitted.

> something that most security conscious people would have figured out by storing it in a password vault. Whatever that is if not another system protected by long password you're likely to lose, or that might bitrot past the point of recovery.

Any security-conscious person backs up their password manager.

Stored encrypted of course with a long password...
Post reply on HN