3 ms·
A simple method is as follows: 0. This mostly matters for the accounts that need to be particularly secure (eg email, maybe GitHub or Facebook or Twitter depen
by dan-robertson 6y ago
A simple method is as follows:
0. This mostly matters for the accounts that need to be particularly secure (eg email, maybe GitHub or Facebook or Twitter depending on how much you care about them). Also accounts for money if they offer this kind of security.
1. Set up a yubikey. Try to only ever use the yubikey for logging in.
2. Set up some account recovery codes, print them out, put them in a safe place (ie somewhere that you don’t live or work, though you could probably also keep copies there. If you have a folder of personal and account information ready in case you die unexpectedly, put it there too)
3. Set up Google Authenticator on an iPhone so you can get in if you don’t have access to your keys. You should treat these more like the recovery codes than the yubikey—be very careful about entering the name of the website and checking the certificate because they won’t protect you from phishing.
- mnahkies 6y ago> Also accounts for money if they offer this kind of security This is something that astonishes me. So many financial institutions still have: - (low) max length limits on passwords - restrictions like no special chars in passwords, or exactly this many numbers etc - over reliance on a pin where a password would be more suitable - no 2fa, or at best SMS based 2fa - ridiculous security questions as if someone's favourite colour etc is drawn from a large pool of values As a developer I can guess that most of these restrictions are probably stemmed from a mountain of tech debt, but I would've expected this to be a priority for such companies. It makes me wonder if they are bound to follow some outdated regulations or something preventing them from doing better
- deleted 6y ago[deleted]