4 ms·

> longtime cryptocurrency investors, and security-minded individuals I'm not sure how "security-minded" you are if you used a centralized, network-accessible p

> longtime cryptocurrency investors, and security-minded individuals I'm not sure how "security-minded" you are if you used a centralized, network-accessible password manager service in the first place. Actual security minded folks keep their password vault on an air gapped machine they maintain full, physical control over. The kind of people who use centralized, networked password managers are, by definition, those who prioritize convenience over security in the first place. Sure, using something like LastPass is better than just saving all of your passwords in your browser, or just using one password everywhere. Citing this as evidence someone is security-minded is like saying someone is environmentally conscious because they recycle aluminum cans, despite driving a Hummer H2 and burning the rest of their trash. Is it better than nothing? Absolutely. Does it make them an environmentalist/security-conscious person on it's own? No. Does it make up for the other shortcomings in strategy? Nowhere remotely close. It's a half-assed baby step for people who want to LARP as being serious about their goal (environmentalism or security), without the slightest ounce of inconvenience to their otherwise completely polluting/insecure habits. Keep driving your H2 and telling yourself you're environmentally friendly. Keep using your PMaaS (password manager as a service) and telling yourself you care about security.

distortedsignal 3y ago
What do passwords do on an airgapped system? Being serious - if the system is already not able to get anywhere, nobody needs to authenticate on it or with it. If you have passwords there, they don't _do_ anything. I'm pretty security minded - the word "security" is in my job role - but my password vault is in Google Drive. I need to have it on many machines, and I want it to be backed up. I know my limits - I don't have the hardware and software infra and expertise that Google does - so I trust them with that data. Could it bite me? Yes, but it would require someone a) downloading my passwords file and b) decrypting it. That's enough steps that I'm confident that I'm safe enough.
- anonym29 3y ago
  > What do passwords do on an airgapped system? Get read and re-entered by exactly 1 person, the only person who's authorized to read them. Oh, sorry, you wanted to copy and paste because you didn't think twice about the security of your clipboard, whether other userland programs are reading your memory? My bad. > I'm pretty security minded - the word "security" is in my job role - but my password vault is in Google Drive. I'm on a corporate red team. People like you with your mindset are why I have a job and why big breaches of F500's that "care about security" will always keep happening. You don't prioritize security, you prioritize convenience, and security is a nice add-on to your convenience. By all means, please continue doing things exactly as you do - my bank account and I will forever be grateful for folks like yourself. Never stop prioritizing your absolute convenience!
  - lxgr 3y ago
    > Oh, sorry, you wanted to copy and paste because you didn't think twice about the security of your clipboard, whether other userland programs are reading your memory? My bad. What do you do about keyloggers? > People like you with your mindset are why I have a job and why big breaches of F500's that "care about security" will always keep happening. And attitudes like this are what sours the relationship of regular users (who are not opposed to security but don’t consider achieving it their main objective) and the security/IT/… team of their company. Provide users an actionable, practicable alternative to their existing insecure practice, or you haven't solved any problem. Ridiculing or belittling your user base doesn't help either.
    - deleted 3y ago
      [deleted]
  - distortedsignal 3y ago
    Sorry, maybe I misstated. This is a PERSONAL store. Not a corporate store. If this gets busted, I’m out a lot of money, but my company is very safe. If you have expertise here, I’d be very interested. What is your backup and restore solution? How do you guarantee that your files are safe? I’m still not sure that we’re using the same definition of “air-gapped” here. From my experience, and air-gapped system is one that is entirely off the network. Like you said, one user, but the system is gapped because there is something dangerous on it. Airgapped systems are used for research. The user should always have root privileges (they can’t mess anything up too badly, and if they do, image the machine or dispose of it in a fire or whatever) so… again, why passwords? What do they do? What do they protect?
    - ephbit 3y ago
      > .. why passwords? What do they do? What do they protect? They protect data/accounts on other machines. Similar to a piece of paper you'd write a password on but probably with added encryption, which would be difficult on paper. Want to sign into account XY on the internet connected machine? Just look up the password (which might be a hard to remember sequence of characters) on the air gapped password machine.
- throwanem 3y ago
  Passwords on an airgapped system stay there where you type them across from that one to another one when you want to authenticate to something. Which, in this model, I suppose you have to do a lot, since obviously no one really security-minded would save a password in a browser. So I hope that airgapped machine isn't too heavy or can't run on batteries.
  - anonym29 3y ago
    Password managers don't need gigabytes of memory, terabytes of storage, and a big, power-hungry x86 CPU. An air gapped machine doesn't necessarily imply a server, a desktop, or even a laptop. Check out the mooltipass, onlykey, beamu, etc. There exist many such devices - some better than others. Note that this isn't an endorsement of the mentioned products, I just mention them as examples. Note also that not all of these devices constitute a true air-gap, though such devices which can display passwords without any kind of connection (be it bluetooth, usb, etc) can still meet that criteria.

distortedsignal 3y ago

What do passwords do on an airgapped system? Being serious - if the system is already not able to get anywhere, nobody needs to authenticate on it or with it. If you have passwords there, they don't _do_ anything. I'm pretty security minded - the word "security" is in my job role - but my password vault is in Google Drive. I need to have it on many machines, and I want it to be backed up. I know my limits - I don't have the hardware and software infra and expertise that Google does - so I trust them with that data. Could it bite me? Yes, but it would require someone a) downloading my passwords file and b) decrypting it. That's enough steps that I'm confident that I'm safe enough.

anonym29 3y ago
> What do passwords do on an airgapped system? Get read and re-entered by exactly 1 person, the only person who's authorized to read them. Oh, sorry, you wanted to copy and paste because you didn't think twice about the security of your clipboard, whether other userland programs are reading your memory? My bad. > I'm pretty security minded - the word "security" is in my job role - but my password vault is in Google Drive. I'm on a corporate red team. People like you with your mindset are why I have a job and why big breaches of F500's that "care about security" will always keep happening. You don't prioritize security, you prioritize convenience, and security is a nice add-on to your convenience. By all means, please continue doing things exactly as you do - my bank account and I will forever be grateful for folks like yourself. Never stop prioritizing your absolute convenience!
- lxgr 3y ago
  > Oh, sorry, you wanted to copy and paste because you didn't think twice about the security of your clipboard, whether other userland programs are reading your memory? My bad. What do you do about keyloggers? > People like you with your mindset are why I have a job and why big breaches of F500's that "care about security" will always keep happening. And attitudes like this are what sours the relationship of regular users (who are not opposed to security but don’t consider achieving it their main objective) and the security/IT/… team of their company. Provide users an actionable, practicable alternative to their existing insecure practice, or you haven't solved any problem. Ridiculing or belittling your user base doesn't help either.
  - deleted 3y ago
    [deleted]
- distortedsignal 3y ago
  Sorry, maybe I misstated. This is a PERSONAL store. Not a corporate store. If this gets busted, I’m out a lot of money, but my company is very safe. If you have expertise here, I’d be very interested. What is your backup and restore solution? How do you guarantee that your files are safe? I’m still not sure that we’re using the same definition of “air-gapped” here. From my experience, and air-gapped system is one that is entirely off the network. Like you said, one user, but the system is gapped because there is something dangerous on it. Airgapped systems are used for research. The user should always have root privileges (they can’t mess anything up too badly, and if they do, image the machine or dispose of it in a fire or whatever) so… again, why passwords? What do they do? What do they protect?
  - ephbit 3y ago
    > .. why passwords? What do they do? What do they protect? They protect data/accounts on other machines. Similar to a piece of paper you'd write a password on but probably with added encryption, which would be difficult on paper. Want to sign into account XY on the internet connected machine? Just look up the password (which might be a hard to remember sequence of characters) on the air gapped password machine.
throwanem 3y ago
Passwords on an airgapped system stay there where you type them across from that one to another one when you want to authenticate to something. Which, in this model, I suppose you have to do a lot, since obviously no one really security-minded would save a password in a browser. So I hope that airgapped machine isn't too heavy or can't run on batteries.
- anonym29 3y ago
  Password managers don't need gigabytes of memory, terabytes of storage, and a big, power-hungry x86 CPU. An air gapped machine doesn't necessarily imply a server, a desktop, or even a laptop. Check out the mooltipass, onlykey, beamu, etc. There exist many such devices - some better than others. Note that this isn't an endorsement of the mentioned products, I just mention them as examples. Note also that not all of these devices constitute a true air-gap, though such devices which can display passwords without any kind of connection (be it bluetooth, usb, etc) can still meet that criteria.