12 ms·

1) Use password manager 2) get asked to help someone else at their machine 3) need to log-in to a remote resource under my own user to do something 4) passwo

1) Use password manager 2) get asked to help someone else at their machine 3) need to log-in to a remote resource under my own user to do something 4) password is in the password manager on my workstation on another floor Solution? Should I: * ask the person to give very exact and detailed instructions on what they need me to accomplish so that I can do that work from my own workstation? * go up to my workstation and call the person who needs help and walk him through logging in as me? * remote-login from their workstation to mine to copy/paste (and hope their workstation's clipboard is secure)? * bring my password manager with me on my phone (and risk my passwords being pwned because phones are Not Secure)? * write down 40 character password somewhere (stick-it note?) and hope I neither typo anything, nor allow others to read it, nor carelessly discard it? * just use a password I made up and can easily remember? I'm sure there's better solutions. Each one has their own annoyances.

heartbreak 9y ago
> * bring my password manager with me on my phone (and risk my passwords being pwned because phones are Not Secure)? As someone who uses this solution to your above-stated problem, I disagree with the assertion that phones are "Not Secure." Care to back that up?
- inetknght 9y ago
  Physical device small enough to be quickly stolen: Not Secure. (this is self-evident: physical access to device is Game Over) Low battery requires plugging in a cable to charge; the cable may be a surreptitiously-installed data cable. I do not trust the hardware or software stack that handles the data cable to be secure. SMS: Not Secure. http://www.cybersecuritytrend.com/topics/cyber-security/articles/424266-nist-has-it-right-sms-not-secure.htm http://www.cybersecuritytrend.com/topics/cyber-security/arti... Wifi: Not Secure. https://www.bestvpn.com/privacy-news/wpa2-wifi-not-secure/ https://www.bestvpn.com/privacy-news/wpa2-wifi-not-secure/ Many apps "require" silly amounts of permissions to the phone before they'll install. Apps' ability to read what's on screen, to be notified of clipboard changes, to listen to sounds; all when not even in the foreground. On my computer, I can easily check what apps and background services are running. Not so easily on a phone.
  - deleted 9y ago
    [deleted]
  - 0xfeba 9y ago
    > On my computer, I can easily check what apps and background services are running. Did you audit the Intel AME, HD firmware, chipset, audio drivers, usb drivers, and everything else on your PC?
  - matthewmacleod 9y ago
    (this is self-evident: physical access to device is Game Over) This is just totally not true. I'd wager a fair sum that passwords stored on an iPhone, behind a decent layer of security, are entirely better protected from physical access than on any general-purpose computer.
    - inetknght 9y ago
      Passwords stored on a general purpose computer, behind a decent layer of security, are entirely better protected from physical access than on any phone I've ever used.
      - lox 9y ago
        Yeah, the FBI totally breezed through the whole iPhone unlock thing. /sarcasm
- yAnonymous 9y ago
  Where do I even start? I think it would be easier for you to tell me why you think phones are secure and then I tell you why you're wrong.
r3bl 9y ago
If I anticipated such action could occur, I would use an "X random words" passphrase pattern. It's long, it's random, you don't have to look at it, and is easily communicated to someone. Heck, I do the same for answers to security questions in case I need to communicate an answer to it for whatever reason.
wgjordan 9y ago
Copy/paste the needed password from your workstation to a text file on a secure USB key, then use the key to copy/paste it into the login on the other workstation and delete the file. > * remote-login from their workstation to mine to copy/paste (and hope their workstation's clipboard is secure)? This option also risks leaving around credentials to remote-login to your workstation. No sense worrying about the workstation's clipboard-security though- if the workstation itself is pwned or intentionally bugged, the password will be at risk from a keylogger or network-sniffing proxy when it's typed in anyway, so no avoiding that risk. Option B is to ask yourself whether a 40-character impossible-to-write-down-without-typos password, phones are Not Secure level of security-paranoia is worth the tradeoff of inconvenience (it may be, depending on the nature of your work).
- inetknght 9y ago
  All good points. FWIW I currently write software which analyzes DNA; privacy and medical issues are real and definite concerns to me.

heartbreak 9y ago

> * bring my password manager with me on my phone (and risk my passwords being pwned because phones are Not Secure)? As someone who uses this solution to your above-stated problem, I disagree with the assertion that phones are "Not Secure." Care to back that up?

inetknght 9y ago
Physical device small enough to be quickly stolen: Not Secure. (this is self-evident: physical access to device is Game Over) Low battery requires plugging in a cable to charge; the cable may be a surreptitiously-installed data cable. I do not trust the hardware or software stack that handles the data cable to be secure. SMS: Not Secure. http://www.cybersecuritytrend.com/topics/cyber-security/articles/424266-nist-has-it-right-sms-not-secure.htm http://www.cybersecuritytrend.com/topics/cyber-security/arti... Wifi: Not Secure. https://www.bestvpn.com/privacy-news/wpa2-wifi-not-secure/ https://www.bestvpn.com/privacy-news/wpa2-wifi-not-secure/ Many apps "require" silly amounts of permissions to the phone before they'll install. Apps' ability to read what's on screen, to be notified of clipboard changes, to listen to sounds; all when not even in the foreground. On my computer, I can easily check what apps and background services are running. Not so easily on a phone.
- deleted 9y ago
  [deleted]
- 0xfeba 9y ago
  > On my computer, I can easily check what apps and background services are running. Did you audit the Intel AME, HD firmware, chipset, audio drivers, usb drivers, and everything else on your PC?
- matthewmacleod 9y ago
  (this is self-evident: physical access to device is Game Over) This is just totally not true. I'd wager a fair sum that passwords stored on an iPhone, behind a decent layer of security, are entirely better protected from physical access than on any general-purpose computer.
  - inetknght 9y ago
    Passwords stored on a general purpose computer, behind a decent layer of security, are entirely better protected from physical access than on any phone I've ever used.
    - lox 9y ago
      Yeah, the FBI totally breezed through the whole iPhone unlock thing. /sarcasm
yAnonymous 9y ago
Where do I even start? I think it would be easier for you to tell me why you think phones are secure and then I tell you why you're wrong.

r3bl 9y ago

If I anticipated such action could occur, I would use an "X random words" passphrase pattern. It's long, it's random, you don't have to look at it, and is easily communicated to someone. Heck, I do the same for answers to security questions in case I need to communicate an answer to it for whatever reason.

wgjordan 9y ago

Copy/paste the needed password from your workstation to a text file on a secure USB key, then use the key to copy/paste it into the login on the other workstation and delete the file. > * remote-login from their workstation to mine to copy/paste (and hope their workstation's clipboard is secure)? This option also risks leaving around credentials to remote-login to your workstation. No sense worrying about the workstation's clipboard-security though- if the workstation itself is pwned or intentionally bugged, the password will be at risk from a keylogger or network-sniffing proxy when it's typed in anyway, so no avoiding that risk. Option B is to ask yourself whether a 40-character impossible-to-write-down-without-typos password, phones are Not Secure level of security-paranoia is worth the tradeoff of inconvenience (it may be, depending on the nature of your work).

inetknght 9y ago
All good points. FWIW I currently write software which analyzes DNA; privacy and medical issues are real and definite concerns to me.