3 ms·

I think about this a lot. This recent tweet from Simon Willison (https://twitter.com/simonw/status/1444071543902912513 https://twitter.com/simonw/status/1444071

by judell 5y ago

I think about this a lot. This recent tweet from Simon Willison (https://twitter.com/simonw/status/1444071543902912513 https://twitter.com/simonw/status/1444071543902912513) really resonates: "One of the most obvious flaws in using blockchains for anything involving regular human beings is one I've not seen much discussion of: Regular human beings cannot protect their passwords, credentials or private keys. They just can't." I guess I'm not a regular human or I wouldn't have an AWS dev account, but I still hardly feel secure w/respect to the continuity of my various digital assets.

chillfox 5y ago
Just being aware of the risks and counters helps a lot. Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.
- dna_polymerase 5y ago
  The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.
  - wahern 5y ago
    At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.
encryptluks2 5y ago
Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.
- mhdhn 5y ago
  how do you do this, any hints?
  - daave 5y ago
    I use LastPass’s Emergency Access feature for this. You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period. There are written instructions for my next of kin on what to look for in the Vault. The main difficulty is if my next of kin forget their LastPass master password. I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.
    - elcritch 5y ago
      One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.
sneak 5y ago
Even users who know how generally fail to properly store, transmit, and authenticate key material. https://youtu.be/9k4GP3Evh9c https://youtu.be/9k4GP3Evh9c
- dspillett 5y ago
  It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox. It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload). I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.

by judell 5y ago

chillfox 5y ago

Just being aware of the risks and counters helps a lot. Most people don't understand the risks beyond "I can get hacked" and because they don't understand the how or basic counters they treat it like a freak weather event that can't be forecast.

dna_polymerase 5y ago
The ability to remember a password or write down backup phrases really goes up when it’s not the access to facebook that can be lost but people’s own money.
- wahern 5y ago
  At least when I was working in the area 10 years ago, most passwords were leaked via brute-force, phishing, or key logging trojans. The latter was far more common than you'd ever think, and also often harvested SSH private keys.

encryptluks2 5y ago

Probably because most people don't care if they get hacked. They've never had major consequences from it. They think that someone will always be there to hold there hand. I am confident in my security. My biggest concern is making sure I have a solid dead man's switch in place before I die or get dementia.

mhdhn 5y ago
how do you do this, any hints?
- daave 5y ago
  I use LastPass’s Emergency Access feature for this. You can designate people who can access your Vault, after a certain waiting period. If they request access prematurely, I can revoke it during the waiting period. There are written instructions for my next of kin on what to look for in the Vault. The main difficulty is if my next of kin forget their LastPass master password. I’ve been thinking of distributing a key via a set of USB stick using Shamir’s secret sharing, with written instructions to use them to recover a backup of the Vault kept offline… but have not gotten around to this.
  - elcritch 5y ago
    One could put an unencrypted usb in a bank safety deposit. I kinda get a kick out of the notion. But yah Shamir’s seems underused.

sneak 5y ago

Even users who know how generally fail to properly store, transmit, and authenticate key material. https://youtu.be/9k4GP3Evh9c https://youtu.be/9k4GP3Evh9c

dspillett 5y ago
It occurs with information transfer as well as storage. I've seen this with people at client organisations with password protected files in email. They understand the need for the security and how to apply it but fail to connect those thoughts to the next hurdle and send the password in another email to the same address. This is like keeping the password in a file in the same directory, or taping the key to the underside of a lockbox. It can happen less obviously too: I've seen it internally where two channels merge: someone sends an encrypted file as an attachment and the password view Skype-for-business, but the Skype conversation is then archived and accessible in the same outlook account (at least not in the same folder, but someone who gets access to the account and scans for credentials will find it and know where to look for the payload). I wish the user of PKI had become easy enough to take off generally, though that only really solves the transmission problem: you still have potential issues with people managing passphrases/passwords for their private keys.