3 ms·
If you don't trust encryption, I'm honestly curious to hear how you handle your sensitive data. My own opinion is that you're being too paranoid, but it would b
by GTP 3y ago
If you don't trust encryption, I'm honestly curious to hear how you handle your sensitive data. My own opinion is that you're being too paranoid, but it would be interesting to hear back from you.
- safety1st 3y agoI trust encryption, but I don't necessarily trust myself to configure everything correctly. I am aware of how complex the topic is and could imagine myself for example having a password on something which could be brute forced if my password wasn't strong enough plus the default lockout period for incorrect attempts was too short... or some other scenario I as a non-expert might not anticipate. In addition to encryption there's a physical access component to how a lot of my secrets are stored, no way I would ever transfer them to a phone for example. Some necessary context for this is that I own a small business and it's not large enough to afford a dedicated person or people setting IT policy, but it's large enough that an attacker would have plenty of motivation to go the extra mile in terms of say doing some social engineering to drain our bank account. Maybe the productive line of thinking here is, there is a set of secrets that does need a really high level of paranoia, but most of them don't and those would be OK sitting encrypted on a phone or USB stick. But it's easy to go down the rabbit hole and say if they get access to X and Y pieces of info can they call someone and get a password reset... etc.
- GTP 3y agoI understand your concern. I would just add that, if the main concern for you would be someone finding such a USB key with encrypted private keys and be willing to use a long time to recover them, that's not really an issue: you only need the encryption to be strong enough for you to notice that you lost the USB key and rotate the keys, if such an adversary needs even just a couple days to perform its attack, you still got enough time IMO.