3 ms·

> 2FA and password managers didn't make us heavily reliant on massive companies. Retool: https://arstechnica.com/security/2023/09/how-google-authenticator-gave

> 2FA and password managers didn't make us heavily reliant on massive companies. Retool: https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/ https://arstechnica.com/security/2023/09/how-google-authenti... Lastpass: https://news.ycombinator.com/item?id=34516275 https://news.ycombinator.com/item?id=34516275

rglullis 3y ago
If Google Authenticator goes away, people will still be able to use 2FA (I for one use Aegis, it's available on F-droid and does everything I need, including encrypted backups) If Lastpass goes away, people will still be able to use keepass or any of the large number of open source password managers, some of them even with browser integrations. If I have a website that is frequently attacked by botnets and Cloudflare goes away, what can I use to replace it?
- gchamonlive 3y ago
  I am sorry, but if your password manager goes away and you have no disaster recovery scenario planned you might not be able to just move to a competitor: https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 My response was to illustrate how insidious big companies are. Of course nothing compares to the backbone of the web going down. If AWS North Virginia suffers widespread downtime to all its availability zones, much of the web will just go dark, no question about it.
bee_rider 3y ago
2FA, I’m not sure. But Lastpass doesn’t represent the whole of password managers. Storing your passwords in an online service is a really silly thing to do (for passwords that matter at least). Use something local like keepass.
- gchamonlive 3y ago
  Hope you plan ahead for a house fire with a 3-2-1 approach for backups. Maintaining an always on off-site storage is expensive unless you resort to cloud solutions like OneDrive or Dropbox, but then you go back to the problem of having your passwords on the cloud, even if encrypted. Not using cloud is just very expensive and time consuming for the average user.
  - adrianN 3y ago
    Passwords are small enough that you can make physical backups easily.
    - gchamonlive 3y ago
      Honest question, because it is interesting and might change how I approach backing up my passwords. How would you go about maintaing that physical copy updated? What I think would make this approach hard is that you would have to ponder if a newly created account is important at creation time in order to know if you should update the off-site, physical copy of your most important passwords (I say this because if you want to backup everything and avoid the cloud entirely it is just not viable, having to update this physical backup for each new account. I am currently at over 400 logins in my pw manager, 2 years ago it was half as much). I think having your passwords encrypted with a high enough entropy master password and a quantum-resistant encryption algorithm, and having an off-site, physical backup of your cloud account credentials is enough for anyone not publicly exposed, like a politician or someone extremely wealthy, even though I would be skeptical these people go through such lengths to protect their online accounts.
      - rglullis 3y ago
        The lesson is not to "avoid" the cloud, but to not be "dependent" on it. Doubly so if the service provided is one that keeps you locked in and can not be ported over. So yes, I feel comfortable with my strategy of having backups on bluray disks + S3. If AWS goes down or decides to jack up their prices to something unacceptable, I will take the physical copies and move then to the dozen others S3-compatible alternatives. I am not dependent on AWS. But I am not interested in using Google Authenticator or Lastpass because that would mean that I am at their mercy.

rglullis 3y ago

If Google Authenticator goes away, people will still be able to use 2FA (I for one use Aegis, it's available on F-droid and does everything I need, including encrypted backups) If Lastpass goes away, people will still be able to use keepass or any of the large number of open source password managers, some of them even with browser integrations. If I have a website that is frequently attacked by botnets and Cloudflare goes away, what can I use to replace it?

gchamonlive 3y ago
I am sorry, but if your password manager goes away and you have no disaster recovery scenario planned you might not be able to just move to a competitor: https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 My response was to illustrate how insidious big companies are. Of course nothing compares to the backbone of the web going down. If AWS North Virginia suffers widespread downtime to all its availability zones, much of the web will just go dark, no question about it.

bee_rider 3y ago

2FA, I’m not sure. But Lastpass doesn’t represent the whole of password managers. Storing your passwords in an online service is a really silly thing to do (for passwords that matter at least). Use something local like keepass.

gchamonlive 3y ago
Hope you plan ahead for a house fire with a 3-2-1 approach for backups. Maintaining an always on off-site storage is expensive unless you resort to cloud solutions like OneDrive or Dropbox, but then you go back to the problem of having your passwords on the cloud, even if encrypted. Not using cloud is just very expensive and time consuming for the average user.
- adrianN 3y ago
  Passwords are small enough that you can make physical backups easily.
  - gchamonlive 3y ago
    Honest question, because it is interesting and might change how I approach backing up my passwords. How would you go about maintaing that physical copy updated? What I think would make this approach hard is that you would have to ponder if a newly created account is important at creation time in order to know if you should update the off-site, physical copy of your most important passwords (I say this because if you want to backup everything and avoid the cloud entirely it is just not viable, having to update this physical backup for each new account. I am currently at over 400 logins in my pw manager, 2 years ago it was half as much). I think having your passwords encrypted with a high enough entropy master password and a quantum-resistant encryption algorithm, and having an off-site, physical backup of your cloud account credentials is enough for anyone not publicly exposed, like a politician or someone extremely wealthy, even though I would be skeptical these people go through such lengths to protect their online accounts.
    - rglullis 3y ago
      The lesson is not to "avoid" the cloud, but to not be "dependent" on it. Doubly so if the service provided is one that keeps you locked in and can not be ported over. So yes, I feel comfortable with my strategy of having backups on bluray disks + S3. If AWS goes down or decides to jack up their prices to something unacceptable, I will take the physical copies and move then to the dozen others S3-compatible alternatives. I am not dependent on AWS. But I am not interested in using Google Authenticator or Lastpass because that would mean that I am at their mercy.