6 ms·

The problem this article touches on is huge, because everybody who has a computer is affected and almost nobody takes the necessary precautions. Especially non-

The problem this article touches on is huge, because everybody who has a computer is affected and almost nobody takes the necessary precautions. Especially non-technical computer users can easily lose years worth of important data. I've tried to set up contingency plans for the cases that I lose access to my: - phone (which contains Google Authenticator with plenty of important logins; unfortunately some of my 2FA is still based on SMS) - my laptop - my Yubikey - my wallet (with ids and a credit card) due to theft, damage (house burns down) or simply loss. Another under-appreciated risk: losing my memory (my master passwords are only in my mind - what happens if suffer a head injury and forget?) Redundancy is one countermeasure: Have more than one bank account + stock portfolio, more than one credit card (servers might go down if a credit card is blocked) and physical devices (phone, laptop) in store to stay operational in case of an emergency. Full machine backups + regular uploads "to the cloud" for raw data; occasional transfers to (multiple) external hard drives. I don't think there is a way around a safe physical space with printed backup codes on it. Ideally not in the same house - maybe with a bank? A list of instructions for numbers to call for account recovery or blocking. Which information will I have to provide? In a similar vein: what happens to my data after I die? How would my (non-technical) family be able to access my pictures and writings? A digital inheritance would be prevented in my security set if I don't prepare. This space is fascinating to explore, the zeros and ones people have stored on their devices are incredibly valuable to them and this treasure is poorly protected. Generally speaking: No backups, weak passwords, outdated software, old hard drives ... risks abound Google surely has very capable security people, but right now my account there is the central vector of attack, most of my passwords can be reset through my email, a huge portion of my communication runs through Gmail, Whatsapp is backed up to my Drive, most of my pictures are on Google. It's probably a good idea to disentangle the situation a bit to be prepared for the case that Google's fortress gets breached one day. Without compromising your security - I'd love to know how others approach their personal IT security challenges?

MattGaiser 6y ago
Digital inheritance would make for a fascinating SaaS company if anyone could figure out the solutions to this.
- jbverschoor 6y ago
  Well. Maybe we should first handle data ownership
- mxschumacher 6y ago
  and closely related: the "digital graveyard", there's this Wired article of a guy who recorded his father and trained a voice model on his written communication [0]. A place to go if we want to be reminded of the voice, handwriting, face or attitude of a loved one. Faraway stone plates on crowded graveyards don't seem appealing to me in a world where families are often dispersed over the globe. [0] https://www.wired.com/story/a-sons-race-to-give-his-dying-father-artificial-immortality/ https://www.wired.com/story/a-sons-race-to-give-his-dying-fa...
  - wasureru 6y ago
    Tangentially, this reminds me a lot of an episode in Black Mirror: https://en.m.wikipedia.org/wiki/Be_Right_Back https://en.m.wikipedia.org/wiki/Be_Right_Back
vicek22 6y ago
> losing my memory (my master passwords are only in my mind - what happens if suffer a head injury and forget?) Not just a head injury, this can easily happen if you find your keychain 10 or 20 years later. I don't think that there is a good solution to it. Maybe biometric data, but then again, I want to have a control over when my data is accessed and in many countries it's legal for law enforcement to make you use your finger or face..
- mxschumacher 6y ago
  and fingers can easily be lost as well... Maybe write down my master password and put it in a safe?
  - Leace 6y ago
    > Maybe write down my master password and put it in a safe? Isn't this just moving the goalpost because what if you forget safe combination?
    - mxschumacher 6y ago
      For a bank safe, you might access the vault with your id and a key. But I see what you mean. It's not perfect. If the Youtube videos I've seen are to be believed then many domestic safes can be broken rather quickly with the right tools,
    - lazyjones 6y ago
      > what if you forget safe combination? Safes with electronic locks typically have (backup) keys too, which you'd need to hide or put in another safe, in case the battery dies.
      - sverhagen 6y ago
        So, still moving goal posts?
        6y ago
Leace 6y ago
> Without compromising your security - I'd love to know how others approach their personal IT security challenges? Most of my security is based on OpenPGP keys stored on a Yubikey. In case the first one is broken/lost I've got another one. If both are lost there is a master copy on an offline computer that can be used to provision more Yubikeys. The key unlocks access to passwords stored in pass. Because pass is based on git and gpg can be used to access SSH then the same yubikey is used to pull/push changes to pass and read encrypted passwords. On both the laptop and the phone (Password Store). Data on the computer is LUKS-encrypted, unlocked by the Yubikey. Full backup of my laptop's SSD is done via btrfs send/receive to a raid1 array of 3 disks (raid1c3) on a regular intervals. A small subset if very important data (documents) is also backed up via restic to S3 and Backblaze. I try to "backup" as much of my work as possible by releasing it as open-source (where it's preserved by the Github etc.) or publishing it on a web-site (where it's preserved by archive.org). > In a similar vein: what happens to my data after I die? How would my (non-technical) family be able to access my pictures and writings? A digital inheritance would be prevented in my security set if I don't prepare. I've been thinking about this lately and maybe it's not a popular opinion but... would people really need your data when you die? I get access to photos (my SO has the PIN code) but everything else? Maybe this is just digital junk? Who would enjoy browsing terabytes of my data looking for... what exactly?
- vicek22 6y ago
  This sounds like my dream setup. Have you written about it somewhere in more detail or could you recommend some resources that you've used for implementing the solution?
  - Leace 6y ago
    Err, nope, this is a work-in-progress. What are you especially interested in? Then I can provide you with details. Some random links I used: - https://btrfs.wiki.kernel.org/index.php/Incremental_Backup https://btrfs.wiki.kernel.org/index.php/Incremental_Backup - https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-part-2/ https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-... - enable touch-to-use so even malicious software cannot access your passwords: https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_touch https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_... - https://www.passwordstore.org/ https://www.passwordstore.org/ - https://play.google.com/store/apps/details?id=dev.msfjarvis.aps https://play.google.com/store/apps/details?id=dev.msfjarvis.... - https://aur.archlinux.org/packages/mkinitcpio-gnupg/ https://aur.archlinux.org/packages/mkinitcpio-gnupg/ (I'm thinking on replacing this with PKCS#11, more keys to manage but PKCS#11 is supported natively with systemd so one less dependency). Hmm... maybe I should really document that...
nyuszika7h 6y ago
Start by not using Google Authenticator. It's outdated and has security vulnerabilities allowing malicious apps to extract your code. And it's impossible to backup without a rooted device. Anything that supports "Google Authenticator" really means any TOTP app is supprted, so for example andOTP on Android may be a good choice. Or you can use Authy or 1Password if you trust them.
- mxschumacher 6y ago
  thank you for the pointer to andOTP - I need to migrate away from SMS based 2FA - then away from Google Authenticator - and probably also from LastPass to Bitwarden
  - Zizizizz 6y ago
    https://getaegis.app/ https://getaegis.app/ This is great too on android https://twofactorauth.org/ https://twofactorauth.org/ Helps out finding how to set it up on certain sites
- notechback 6y ago
  I had Google authenticator as 2FA. Phone broke and I must have typo while doing a regular password change - now I have no way to again log into my account as i can't provide the 2FA and none of the other options work (providing old contact emails, phone code, backup email, ... All doesn't matter just because I don't have the authenticator).
BrandoElFollito 6y ago
I would first write down the master passwords, and store them somewhere safe. It does not have to be fort knox safe, enough if stored at a trusted place which has no direct relation with you (in my case it is my best friend I trust with my life)
mackrevinack 6y ago
something like aegis is much better than googles authenticator. you can backup your keys and store them somewhere secure (veracrypt or whatever) and it also lets you choose a custom icons which makes it a bit easier to see what is what at a glance

MattGaiser 6y ago

Digital inheritance would make for a fascinating SaaS company if anyone could figure out the solutions to this.

jbverschoor 6y ago
Well. Maybe we should first handle data ownership
mxschumacher 6y ago
and closely related: the "digital graveyard", there's this Wired article of a guy who recorded his father and trained a voice model on his written communication [0]. A place to go if we want to be reminded of the voice, handwriting, face or attitude of a loved one. Faraway stone plates on crowded graveyards don't seem appealing to me in a world where families are often dispersed over the globe. [0] https://www.wired.com/story/a-sons-race-to-give-his-dying-father-artificial-immortality/ https://www.wired.com/story/a-sons-race-to-give-his-dying-fa...
- wasureru 6y ago
  Tangentially, this reminds me a lot of an episode in Black Mirror: https://en.m.wikipedia.org/wiki/Be_Right_Back https://en.m.wikipedia.org/wiki/Be_Right_Back

vicek22 6y ago

> losing my memory (my master passwords are only in my mind - what happens if suffer a head injury and forget?) Not just a head injury, this can easily happen if you find your keychain 10 or 20 years later. I don't think that there is a good solution to it. Maybe biometric data, but then again, I want to have a control over when my data is accessed and in many countries it's legal for law enforcement to make you use your finger or face..

mxschumacher 6y ago
and fingers can easily be lost as well... Maybe write down my master password and put it in a safe?
- Leace 6y ago
  > Maybe write down my master password and put it in a safe? Isn't this just moving the goalpost because what if you forget safe combination?
  - mxschumacher 6y ago
    For a bank safe, you might access the vault with your id and a key. But I see what you mean. It's not perfect. If the Youtube videos I've seen are to be believed then many domestic safes can be broken rather quickly with the right tools,
  - lazyjones 6y ago
    > what if you forget safe combination? Safes with electronic locks typically have (backup) keys too, which you'd need to hide or put in another safe, in case the battery dies.
    - sverhagen 6y ago
      So, still moving goal posts?
      - 6y ago

Leace 6y ago

> Without compromising your security - I'd love to know how others approach their personal IT security challenges? Most of my security is based on OpenPGP keys stored on a Yubikey. In case the first one is broken/lost I've got another one. If both are lost there is a master copy on an offline computer that can be used to provision more Yubikeys. The key unlocks access to passwords stored in pass. Because pass is based on git and gpg can be used to access SSH then the same yubikey is used to pull/push changes to pass and read encrypted passwords. On both the laptop and the phone (Password Store). Data on the computer is LUKS-encrypted, unlocked by the Yubikey. Full backup of my laptop's SSD is done via btrfs send/receive to a raid1 array of 3 disks (raid1c3) on a regular intervals. A small subset if very important data (documents) is also backed up via restic to S3 and Backblaze. I try to "backup" as much of my work as possible by releasing it as open-source (where it's preserved by the Github etc.) or publishing it on a web-site (where it's preserved by archive.org). > In a similar vein: what happens to my data after I die? How would my (non-technical) family be able to access my pictures and writings? A digital inheritance would be prevented in my security set if I don't prepare. I've been thinking about this lately and maybe it's not a popular opinion but... would people really need your data when you die? I get access to photos (my SO has the PIN code) but everything else? Maybe this is just digital junk? Who would enjoy browsing terabytes of my data looking for... what exactly?

vicek22 6y ago
This sounds like my dream setup. Have you written about it somewhere in more detail or could you recommend some resources that you've used for implementing the solution?
- Leace 6y ago
  Err, nope, this is a work-in-progress. What are you especially interested in? Then I can provide you with details. Some random links I used: - https://btrfs.wiki.kernel.org/index.php/Incremental_Backup https://btrfs.wiki.kernel.org/index.php/Incremental_Backup - https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-part-2/ https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-... - enable touch-to-use so even malicious software cannot access your passwords: https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_touch https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_... - https://www.passwordstore.org/ https://www.passwordstore.org/ - https://play.google.com/store/apps/details?id=dev.msfjarvis.aps https://play.google.com/store/apps/details?id=dev.msfjarvis.... - https://aur.archlinux.org/packages/mkinitcpio-gnupg/ https://aur.archlinux.org/packages/mkinitcpio-gnupg/ (I'm thinking on replacing this with PKCS#11, more keys to manage but PKCS#11 is supported natively with systemd so one less dependency). Hmm... maybe I should really document that...

nyuszika7h 6y ago

Start by not using Google Authenticator. It's outdated and has security vulnerabilities allowing malicious apps to extract your code. And it's impossible to backup without a rooted device. Anything that supports "Google Authenticator" really means any TOTP app is supprted, so for example andOTP on Android may be a good choice. Or you can use Authy or 1Password if you trust them.

mxschumacher 6y ago
thank you for the pointer to andOTP - I need to migrate away from SMS based 2FA - then away from Google Authenticator - and probably also from LastPass to Bitwarden
- Zizizizz 6y ago
  https://getaegis.app/ https://getaegis.app/ This is great too on android https://twofactorauth.org/ https://twofactorauth.org/ Helps out finding how to set it up on certain sites
notechback 6y ago
I had Google authenticator as 2FA. Phone broke and I must have typo while doing a regular password change - now I have no way to again log into my account as i can't provide the 2FA and none of the other options work (providing old contact emails, phone code, backup email, ... All doesn't matter just because I don't have the authenticator).

BrandoElFollito 6y ago

I would first write down the master passwords, and store them somewhere safe. It does not have to be fort knox safe, enough if stored at a trusted place which has no direct relation with you (in my case it is my best friend I trust with my life)

mackrevinack 6y ago

something like aegis is much better than googles authenticator. you can backup your keys and store them somewhere secure (veracrypt or whatever) and it also lets you choose a custom icons which makes it a bit easier to see what is what at a glance