6 ms·
We swiped an idea from launching Nuclear Missiles: Typically you need two keys from two people to launch. For really important accounts - we have three people
by benjohnson 9y ago
We swiped an idea from launching Nuclear Missiles: Typically you need two keys from two people to launch.
For really important accounts - we have three people who each know two thirds of the password. It requires two people to then log in and do damage.
For example if the root password was CatDogFish then
Person1: CatDog_
Person2: _DogFish
Person3: Cat_Fish
Two people can then log in and watch what the other person is doing.
- jasonjayr 9y agoThis is like an informal version of Shamir's Secret Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing
- rcthompson 9y agoMaybe someone should implement a PAM module or something that requires authenticating as two different users with sudo privileges, so you can implement this for as many users as you like and let them each have a single password, instead of half of a password for each possible pair of users.
- ars 9y agoIf would also have to do session sharing so both people can watch each other and see what commands they run.
- seanp2k2 9y agoUse something with 2FA like e.g. https://duo.com/docs/duounix https://duo.com/docs/duounix and give person A the password and person B the 2nd factor (phone with this Duo profile configured or whatever).
- rcthompson 9y agoThat doesn't eliminate the need to set up an account & password for every possible pair of users, rather than just every user.
- ars 9y agoThat only sort of helps. Do both people also watch each other while they run commands? Because if not, once you are admin, you can install programs that let you become admin again at will.
- benjohnson 9y agoYes! We swiped the idea from the military. In certain dangerous places, they require two people to be there or nobody. One person is not allowed. https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
- shif 9y agoWhat if one of the people that has part of the key gets mad and leaves without sharing it?
- livingparadox 9y agoThen you still have two users with a complete password set, from which you can either reconstruct the third permutation or generate a new set.
- seanp2k2 9y agohttps://blog.threatstack.com/who-watches-the-watchmen-securing-configuration-management-systems https://blog.threatstack.com/who-watches-the-watchmen-securi... // https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%... this idea has been around for a very long time.
- MichaelGG 9y agoSo one person runs a keylogger and captures the full credentials? But it's not a bad system.
- ams6110 9y agoWell whoever set that up knows the whole password right?
- pavement 9y agoNope. It could be system generated and disseminated over secure channels. Password rotation becomes necessary, and a little bit riskier, because now you have to deal with accidental lock-outs in a sane, coordinated manner.
- throwaway2048 9y agoand who implements the system that generates and disseminates over secure channel? You are stuck trusting somebody, no matter what. Its turtles all the way down.
- pavement 9y agoEh, 3 pieces of a randomly generated string... hashed in memory, and only the result of the hash function is stored. Pretty basic concept. Soon, dear throwaway, you'll be telling me we should live in fear of the locksmiths, for all their key blanks and such fiendish metal files to abrade them with. What if they should file down a butter knife into the shape of my precious bicycle chain's key?
- throwaway2048 9y agoI didn't say you should be afraid, simply that trying to build a system that doesn't require you to trust people is a fools errand.