3 ms·
> He connects to the Internet only through an encrypted, password-protected channel, and copies and pastes his password from a USB thumb drive. He never types i
by wcoenen 15y ago
> He connects to the Internet only through an encrypted, password-protected channel, and copies and pastes his password from a USB thumb drive. He never types in a password directly, because, he said, “the Chinese are very good at installing key-logging software on your laptop.”
Apparently he didn't realize that it's also trivial for snooping software to monitor the clipboard content.
- kylemaxwell 15y agoNot to mention access everything on the external drive. Relying on one-factor authentication when the system may be (well, is) in the hands of the enemy is just asking for trouble. Use a token or smartcard in addition to your password.
- drewda 15y agoI've found it surprisingly easy to start using two-factor authentication using Google Authenticator: http://code.google.com/p/google-authenticator/ http://code.google.com/p/google-authenticator/
- bigiain 15y agoI wouldn't rely on Google Authenticator to secure my logins from a "government national security" level attacker. If they're capable of installing keyloggers at customs inspection, I suspect they're also capable of imaging my phone at the same time. While I'm _reasonably_ confident the crypto in the app is probably done right, the truth is I've got barely 13bits of entropy in my unlock code for Authenticator - and I could easily work out how to brute-force it given a realistic "government security agency" sized IT infrastructure. (Hell - even spinning up 10,000 EC2 instances for long enough to crank up the android simulator and try all possible 4 digit "PINs" one at a time would probably only cost "nice dinner out" kind of money…)