4 ms·

> I've got certain frequently used commands / passwords / passphrases programmed in those buttons (color coded: green for gpg passphrase, blue for ssh, red for

> I've got certain frequently used commands / passwords / passphrases programmed in those buttons (color coded: green for gpg passphrase, blue for ssh, red for login, etc) Isn't that rather unwise? Your keyboard has become your key to everything. A password manager and/or USB security key and/or smartphone key vault are much better places to store secrets.

ramses0 3y ago
Yeah, I should switch my one USB device that emits keyboard HID events for another USB device that also emits keyboard HID events but is smaller, easier to lose, and has less buttons. ;-) But yes, I agree with you in principle. In practice, locks are delaying devices and I'm much more worried about MITM or software/malware/supply-chain attacks than physical access attacks to my home office. "Passwords in the keyboard" require a physical presence to access rather than attacking the password-store or sniffing them from environment variables, temp-files, etc. Can't hack the keyboard unless I'm the one pushing they keys. After using this setup for a few years, it's been pretty convenient and not totally off the rails w.r.t. security best practices and recommendations: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... 99% of my passwords are in vaults of some sort and are subsequently backstopped by 2FA/Authenticators. In the case of heightened paranoia (or if anyone other than my immediate family had any kind of access to my office), you could even do something like `1234-$MAGIC_KEYSTROKE-5678`, or `amazon-$MAGIC-2023-01-01` making it a bit more like length-increaser in the "bring-something, know-something, be-something" triangle of authentication. Buy one and try it! Buy one of these too, and report back if you think it can help your security posture: https://www.securedrive.com/product/secureusb-kp-encrypted-flash-drive https://www.securedrive.com/product/secureusb-kp-encrypted-f... ...I'd like to get one and try and figure out how to temp-mount my core password-store, then share/auth that between my various home computers.

ramses0 3y ago

Yeah, I should switch my one USB device that emits keyboard HID events for another USB device that also emits keyboard HID events but is smaller, easier to lose, and has less buttons. ;-) But yes, I agree with you in principle. In practice, locks are delaying devices and I'm much more worried about MITM or software/malware/supply-chain attacks than physical access attacks to my home office. "Passwords in the keyboard" require a physical presence to access rather than attacking the password-store or sniffing them from environment variables, temp-files, etc. Can't hack the keyboard unless I'm the one pushing they keys. After using this setup for a few years, it's been pretty convenient and not totally off the rails w.r.t. security best practices and recommendations: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... 99% of my passwords are in vaults of some sort and are subsequently backstopped by 2FA/Authenticators. In the case of heightened paranoia (or if anyone other than my immediate family had any kind of access to my office), you could even do something like `1234-$MAGIC_KEYSTROKE-5678`, or `amazon-$MAGIC-2023-01-01` making it a bit more like length-increaser in the "bring-something, know-something, be-something" triangle of authentication. Buy one and try it! Buy one of these too, and report back if you think it can help your security posture: https://www.securedrive.com/product/secureusb-kp-encrypted-flash-drive https://www.securedrive.com/product/secureusb-kp-encrypted-f... ...I'd like to get one and try and figure out how to temp-mount my core password-store, then share/auth that between my various home computers.