4 ms·

Using passwords is not something very comfortable, and needing to remember a password to a password manager, has some risks, like suddenly forgetting. Using a y

Using passwords is not something very comfortable, and needing to remember a password to a password manager, has some risks, like suddenly forgetting. Using a yubikey is also not very practical since it can be stolen or lost. A phone is always with us, and has small chances of being lost (also there are backups).

bennysonething 4y ago
I use a yubikey to secure my passwordsafe file https://pwsafe.org/ https://pwsafe.org/ Password safe runs on multiple operating systems. I sync my file to cloud storage so it's up to date on all my devices I have a backup key in a drawer and one on me at all times. I really need to buy a few more backup keys. It's not a perfect set up but it works for me.
- waych 4y ago
  Consider trying SyncThing to sync your files between your personal devices, rather than entrusting access to your data to a cloud provider. I did this recently and the experience has been surprisingly way easier and better than I could have imagined.
  - bennysonething 4y ago
    That looks great. Looks it might be viable for me. Security risk in my setup is is cloud storage. And also I'm relying on a password safe Dropbox sync app.
account-5 4y ago
A phone has the same chances of being lost and I would say a higher chance of being stolen. My question would be who is in control of the backups? The same vendors who want to lock you into their ecosystem?
- b112 4y ago
  And the same ones that also lock you out without recourse?
- worldsavior 4y ago
  > A phone has the same chances of being lost and I would say a higher chance of being stolen. Not the same as a small key that can be stolen. > My question would be who is in control of the backups? The same vendors who want to lock you into their ecosystem? You, as it's encrypted (in case of apple, not sure about Google). Backup is up to you, you can also backup to other services such as nextcloud.
fbdab103 4y ago
Phone has a significantly higher chance of breaking. Owner of a Pixel that just died in my hands. Had I not been with company that day, I would have been in a real situation. Edit: also, if I keep it on the phone, will Apple/Google deign grant me access to export my secrets on demand or will they deem I cannot be trusted with such power?
- worldsavior 4y ago
  > Phone has a significantly higher chance of breaking. _Breaking in_ is very hard since the security model for phones is very high, especially in cases of Pixels and iPhones. Even if a pin is used, the security chip makes it very hard to break in. If you mean also in case of losing it: Not as a small device that has much more higher chances of being lost. > Edit: also, if I keep it on the phone, will Apple/Google deign grant me access to export my secrets on demand or will they deem I cannot be trusted with such power? Don't know about that, since passkeys are still pretty new, but probably it will be an option. Does a yubikey allows you to export secrets? Edit: typo
  - Godel_unicode 4y ago
    > Does a yubikey allows you to export secrets No, that would defeat the purpose. If you want exportable secrets just use a thumb drive.
    - worldsavior 4y ago
      That was a rhetorical question.
      - deleted 4y ago
        [deleted]
      - deleted 4y ago
        [deleted]

bennysonething 4y ago

I use a yubikey to secure my passwordsafe file https://pwsafe.org/ https://pwsafe.org/ Password safe runs on multiple operating systems. I sync my file to cloud storage so it's up to date on all my devices I have a backup key in a drawer and one on me at all times. I really need to buy a few more backup keys. It's not a perfect set up but it works for me.

waych 4y ago
Consider trying SyncThing to sync your files between your personal devices, rather than entrusting access to your data to a cloud provider. I did this recently and the experience has been surprisingly way easier and better than I could have imagined.
- bennysonething 4y ago
  That looks great. Looks it might be viable for me. Security risk in my setup is is cloud storage. And also I'm relying on a password safe Dropbox sync app.

account-5 4y ago

A phone has the same chances of being lost and I would say a higher chance of being stolen. My question would be who is in control of the backups? The same vendors who want to lock you into their ecosystem?

b112 4y ago
And the same ones that also lock you out without recourse?
worldsavior 4y ago
> A phone has the same chances of being lost and I would say a higher chance of being stolen. Not the same as a small key that can be stolen. > My question would be who is in control of the backups? The same vendors who want to lock you into their ecosystem? You, as it's encrypted (in case of apple, not sure about Google). Backup is up to you, you can also backup to other services such as nextcloud.

fbdab103 4y ago

Phone has a significantly higher chance of breaking. Owner of a Pixel that just died in my hands. Had I not been with company that day, I would have been in a real situation. Edit: also, if I keep it on the phone, will Apple/Google deign grant me access to export my secrets on demand or will they deem I cannot be trusted with such power?

worldsavior 4y ago
> Phone has a significantly higher chance of breaking. _Breaking in_ is very hard since the security model for phones is very high, especially in cases of Pixels and iPhones. Even if a pin is used, the security chip makes it very hard to break in. If you mean also in case of losing it: Not as a small device that has much more higher chances of being lost. > Edit: also, if I keep it on the phone, will Apple/Google deign grant me access to export my secrets on demand or will they deem I cannot be trusted with such power? Don't know about that, since passkeys are still pretty new, but probably it will be an option. Does a yubikey allows you to export secrets? Edit: typo
- Godel_unicode 4y ago
  > Does a yubikey allows you to export secrets No, that would defeat the purpose. If you want exportable secrets just use a thumb drive.
  - worldsavior 4y ago
    That was a rhetorical question.
    - deleted 4y ago
      [deleted]
    - deleted 4y ago
      [deleted]