4 ms·

Do you and people you know have a safe? Where I'm from, we generally don't use safes. Do you consider your safe to be... safe? I'd imagine it to be relatively

by tasuki 4y ago

Do you and people you know have a safe? Where I'm from, we generally don't use safes. Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe.

cyberbanjo 4y ago
Relatively easy? Relative to what?
- jaggederest 4y ago
  Relative to the wrench attack, I guess: https://xkcd.com/538/ https://xkcd.com/538/
- saltcured 4y ago
  Relative to a naively imagined abstraction of a safe, perhaps. A decent home safe can be reasonable protection against that loose scrap of paper with backup codes ending up in the trash can and may even keep it legible in the event of a house fire. But it is true, it won't be much help if you are targeted by safe crackers.
maxfurman 4y ago
A safe is extremely safe against hackers on the other side of the world. Quite safe against more local threats without special equipment and time on their hands. Security is relative to your threat model!
tedivm 4y ago
Most decent safes are not trivial to pick, often using circular keys instead of the flat ones requiring a different type of pick. Newer safes don't even have keyholes but require that you actually know the combination. As for drilling or sawing through it, that's going to take hours to do.
- JohnFen 4y ago
  > As for drilling or sawing through it, that's going to take hours to do. This is true for expensive commercial safes, but not for home safes. You can drill/saw through them relatively quickly. What you can't do is drill/saw through them without making a whole lot of noise.
justeleblanc 4y ago
> Do you and people you know have a safe? Yes. I'm not taking about a safe like you can see in the movies. Just a locked box. > Where I'm from, we generally don't use safes. That's on you. > Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe. That's not the point. 2FA is about thwarting password leaks. If someone has physical access to my house and knows my passwords, I'm screwed, yes. But since I don't live in a Jason Bourne movie, my threat model isn't a ninja who steals my passwords then comes into my house to hack my tiktok account. My threat model is breaking my phone and knowing that my backup passwords are in a minimally safe place where I expect them to be and weren't carelessly thrown away with old documents; and deter casual "attackers" like a niece who could be inclined to plunder my papers for coloring material. And if I did live in a Jason Bourne movie, I'd expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe.
- cooperadymas 4y ago
  > And if I did live in a Jason Bourne movie, I'd expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe. Here I was thinking you might blow him up with the toaster. Or crash him into a garbage truck after an extenuated car chase.
  - TeMPOraL 4y ago
    We live in the era of smart toasters. You'll need to use your 2FA tool before you can blow someone up with it, which kind of defeats the point when chased by a ninja that's after your 2FA tool.
- mardifoufs 4y ago
  So 2FA is just for the tiny, tiny minority with a safe? What... Am I missing an obvious joke here?
  - deadbunny 4y ago
    Or you know, a drawer with a notebook in it.
jacobsenscott 4y ago
Just keep the backup codes in your wallet - most people protect their wallets pretty well.
- ndsipa_pomu 4y ago
  I'd recommend obfuscating the codes in the event that you lose your wallet. You don't want a bad actor to find it and realise they can gain control of your account though they'd need to figure out your email first.
  - jacobsenscott 4y ago
    They need to figure out your email and password from your wallet contents, which is improbable. Anyone who takes your wallet just wants the cash and credit cards - and they toss the rest.
- darkvertex 4y ago
  You can also buy a few cheap RFID stickers that can be overwritten from your phone. The cheapest stores like a kilobyte or so, which is plenty for quite a few codes. You can glue them in inconspicuous "boring" places in plain sight, like under a mousepad or behind a movie poster hung on the wall. Great way to hide secrets in your home without owning a traditional safe (which just screams "steal me! I'm the valuable thing in the room!" anyway.)
- NoZebra120vClip 4y ago
  I keep all the backup codes in my wallet, next to the $5000 in small bills. /s My backup codes are filed in an expando-file. There are far too many to cram into a wallet. Also, if I'm carrying them around with me when I don't need them, my risk/threat model now includes loss and theft of wallet. That's ridiculous and unnecessary.
  - jacobsenscott 4y ago
    Why would you label your backup codes as to what they go to? Of course that's silly. But if someone does get your wallet they still need to know the website they are for as well as your login and password. It is low risk. Or just ignore the backup codes altogether. We mostly have "fake 2fa" - where you can reset your 2fa auth if you lose your device because otherwise customer support would be impossible. Almost every service allows this.
blendergeek 4y ago
The main purpose of a home "safe" is fire protection. If my house burns down, the contents of my safe should be fine. Obviously a sufficiently motivated adversary can get in. But that (usually) isn't something I am worried about. Most internet hackers do not physically break into houses and open safes.
- organsnyder 4y ago
  Yeah, we actually keep the key in the lock in ours. If someone gets in and really wants to steal it (note to potential thieves: there isn't anything worth your while), they could just carry the whole safe with them. It's only for preserving important documents in case of fire.
  - kbenson 4y ago
    Many safes allow for securing to the floor, making porting it away require a bit more effort, possibly including power tools which are quite loud. Also they're quite heavy usually. I remember as a child someone broke into our house while we were away to steal stuff. The safe wasn't bolted down, and they carried it from one end of the house to the other before giving up, either because they got spooked by something and bolted or because it was just too damn heavy. Think about the logistics of it. If they're stealing a safe, that probably requires a vehicle. A vehicle is more identifiable and unless stolen makes it easier to track people if noticed or recorded. If stolen, there's a chance it will cause a problem immediately before, during or after the crime. If they don't use a vehicle, all the benefits of not using one, such as being able to take non-road paths and blend into crowds are negated. And if they choose to crack the safe on location, that adds time to the crime while doing so, and all time spent at the location of the crime increases the chance they'll be caught because someone notes something suspicious. Like a lock on a house a safe within a house serves it's purpose not by making it impossible to gain access but by making it much more troublesome and likely to be noticed, changing the risk to reward ratio.
- wintogreen74 4y ago
  Th "protection" from home safes is a joke: typically 30-60 minutes at temperatures less than the heat generated by a house fire.
wintogreen74 4y ago
or a little water damage, or a fire lasting more than 30 minutes.
kingcharles 4y ago
My entire storage building just burned to the ground with my safe in it, all my paper codes, my laptop with all my auth on it. Luckily by sheer fluke my phone was saved which has my TOTP apps on it or I would never get into anything again.
- ISL 4y ago
  Why did the safe fail to protect the paper -- too hot, too long?
  - kingcharles 4y ago
    Lol the water from the fire service did more damage. Fire proof, but not high pressure water proof.

by tasuki 4y ago

cyberbanjo 4y ago

Relatively easy? Relative to what?

jaggederest 4y ago
Relative to the wrench attack, I guess: https://xkcd.com/538/ https://xkcd.com/538/
saltcured 4y ago
Relative to a naively imagined abstraction of a safe, perhaps. A decent home safe can be reasonable protection against that loose scrap of paper with backup codes ending up in the trash can and may even keep it legible in the event of a house fire. But it is true, it won't be much help if you are targeted by safe crackers.

maxfurman 4y ago

A safe is extremely safe against hackers on the other side of the world. Quite safe against more local threats without special equipment and time on their hands. Security is relative to your threat model!

tedivm 4y ago

Most decent safes are not trivial to pick, often using circular keys instead of the flat ones requiring a different type of pick. Newer safes don't even have keyholes but require that you actually know the combination. As for drilling or sawing through it, that's going to take hours to do.

JohnFen 4y ago
> As for drilling or sawing through it, that's going to take hours to do. This is true for expensive commercial safes, but not for home safes. You can drill/saw through them relatively quickly. What you can't do is drill/saw through them without making a whole lot of noise.

justeleblanc 4y ago

> Do you and people you know have a safe? Yes. I'm not taking about a safe like you can see in the movies. Just a locked box. > Where I'm from, we generally don't use safes. That's on you. > Do you consider your safe to be... safe? I'd imagine it to be relatively easy to get into, by picking the lock or sawing through the safe. That's not the point. 2FA is about thwarting password leaks. If someone has physical access to my house and knows my passwords, I'm screwed, yes. But since I don't live in a Jason Bourne movie, my threat model isn't a ninja who steals my passwords then comes into my house to hack my tiktok account. My threat model is breaking my phone and knowing that my backup passwords are in a minimally safe place where I expect them to be and weren't carelessly thrown away with old documents; and deter casual "attackers" like a niece who could be inclined to plunder my papers for coloring material. And if I did live in a Jason Bourne movie, I'd expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe.

cooperadymas 4y ago
> And if I did live in a Jason Bourne movie, I'd expect the ninja to just beat me up when I get home and unlock my safe for him, assuming I had bought an unbreakable safe. Here I was thinking you might blow him up with the toaster. Or crash him into a garbage truck after an extenuated car chase.
- TeMPOraL 4y ago
  We live in the era of smart toasters. You'll need to use your 2FA tool before you can blow someone up with it, which kind of defeats the point when chased by a ninja that's after your 2FA tool.
mardifoufs 4y ago
So 2FA is just for the tiny, tiny minority with a safe? What... Am I missing an obvious joke here?
- deadbunny 4y ago
  Or you know, a drawer with a notebook in it.

jacobsenscott 4y ago

Just keep the backup codes in your wallet - most people protect their wallets pretty well.

ndsipa_pomu 4y ago
I'd recommend obfuscating the codes in the event that you lose your wallet. You don't want a bad actor to find it and realise they can gain control of your account though they'd need to figure out your email first.
- jacobsenscott 4y ago
  They need to figure out your email and password from your wallet contents, which is improbable. Anyone who takes your wallet just wants the cash and credit cards - and they toss the rest.
darkvertex 4y ago
You can also buy a few cheap RFID stickers that can be overwritten from your phone. The cheapest stores like a kilobyte or so, which is plenty for quite a few codes. You can glue them in inconspicuous "boring" places in plain sight, like under a mousepad or behind a movie poster hung on the wall. Great way to hide secrets in your home without owning a traditional safe (which just screams "steal me! I'm the valuable thing in the room!" anyway.)
NoZebra120vClip 4y ago
I keep all the backup codes in my wallet, next to the $5000 in small bills. /s My backup codes are filed in an expando-file. There are far too many to cram into a wallet. Also, if I'm carrying them around with me when I don't need them, my risk/threat model now includes loss and theft of wallet. That's ridiculous and unnecessary.
- jacobsenscott 4y ago
  Why would you label your backup codes as to what they go to? Of course that's silly. But if someone does get your wallet they still need to know the website they are for as well as your login and password. It is low risk. Or just ignore the backup codes altogether. We mostly have "fake 2fa" - where you can reset your 2fa auth if you lose your device because otherwise customer support would be impossible. Almost every service allows this.

blendergeek 4y ago

The main purpose of a home "safe" is fire protection. If my house burns down, the contents of my safe should be fine. Obviously a sufficiently motivated adversary can get in. But that (usually) isn't something I am worried about. Most internet hackers do not physically break into houses and open safes.

organsnyder 4y ago
Yeah, we actually keep the key in the lock in ours. If someone gets in and really wants to steal it (note to potential thieves: there isn't anything worth your while), they could just carry the whole safe with them. It's only for preserving important documents in case of fire.
- kbenson 4y ago
  Many safes allow for securing to the floor, making porting it away require a bit more effort, possibly including power tools which are quite loud. Also they're quite heavy usually. I remember as a child someone broke into our house while we were away to steal stuff. The safe wasn't bolted down, and they carried it from one end of the house to the other before giving up, either because they got spooked by something and bolted or because it was just too damn heavy. Think about the logistics of it. If they're stealing a safe, that probably requires a vehicle. A vehicle is more identifiable and unless stolen makes it easier to track people if noticed or recorded. If stolen, there's a chance it will cause a problem immediately before, during or after the crime. If they don't use a vehicle, all the benefits of not using one, such as being able to take non-road paths and blend into crowds are negated. And if they choose to crack the safe on location, that adds time to the crime while doing so, and all time spent at the location of the crime increases the chance they'll be caught because someone notes something suspicious. Like a lock on a house a safe within a house serves it's purpose not by making it impossible to gain access but by making it much more troublesome and likely to be noticed, changing the risk to reward ratio.
wintogreen74 4y ago
Th "protection" from home safes is a joke: typically 30-60 minutes at temperatures less than the heat generated by a house fire.

wintogreen74 4y ago

or a little water damage, or a fire lasting more than 30 minutes.

kingcharles 4y ago

My entire storage building just burned to the ground with my safe in it, all my paper codes, my laptop with all my auth on it. Luckily by sheer fluke my phone was saved which has my TOTP apps on it or I would never get into anything again.

ISL 4y ago
Why did the safe fail to protect the paper -- too hot, too long?
- kingcharles 4y ago
  Lol the water from the fire service did more damage. Fire proof, but not high pressure water proof.