5 ms·

I don't mean it as snark but when it takes 12 hours to reset all of your passwords, that's a lot of digital "stuff" for a minimalist. At what point does the psy

I don't mean it as snark but when it takes 12 hours to reset all of your passwords, that's a lot of digital "stuff" for a minimalist. At what point does the psychic load of all the digital things equal the foregone physical things?

pieterhg 13y ago
You're spot on. That's a very good point. I guess I'm not a minimalist in the digital realm.
- aestra 13y ago
  I think you need a better system. Seriously, I just don't understand I guess I don't get it. I keep my browser on "forget everything on close" mode and I keep my passwords in a password manager all auto generated passwords. If I were to get robbed I would have to reset exactly zero passwords. Forgive me for being stupid, (I'm not trying yo be mean) but where you logged into every service you ever signed up for when you were robbed? Did you ever think to sign out after you were done? This is a personal preference, but I sign in, do my business, and then sign out after I'm done with the service.
  - pieterhg 13y ago
    My main business is running a YouTube network so I'm signed into about 10 accounts in one browser session. Merely, to maintain my channels. All passwords are 16-character random strings with two-factor authentication enabled. So if I'd let my browser "forget everything on close" as you mention, that'd take even longer every morning to sign in to all these accounts. Opening up my password manager on my phone, then writing the 16-char password, then entering the two-factor auth code takes about a minute for each account. So that's 10 minutes to sign in to all those accounts. A bit too much for me to start my day with :) Then there's my personal email, my work email, my web server logins etc. It all adds up, that I'd rather save the sessions. But I agree, there's definitely space for some digital minimalism here :)
    - zAy0LfpBZLC8mAC 13y ago
      Well, I never thought it made much sense, but: What's the point of "two-factor", when the second factor isn't actually ever required? I mean, what is "two factor" about that setup?
      - pieterhg 13y ago
        Good point. Two-factor auth is required on any other browser session or device without the session cookie. It's also reset every 30 days, so you'll have to re-enter it even if you still have a session running.
        zAy0LfpBZLC8mAC 13y ago
        Well, the first factor presumably is also required in order to get a new session cookie, so what's the point of the second factor there? And if someone breaks into your system, they'll have both your password and your session cookie, so they don't need the second factor either (well, except after 30 days after you have reinstalled your system, which I would think is plenty of time to abuse your account). Really, IMO two-factor authentication only makes sense where a separate challenge-response round is required for each transaction, so a replay of stolen credentials is impossible - as it's usually done with online banking. And against burglars, you can protect your cookies as well as your passwords by encrypting the disk contents. Just be aware of cold boot and DMA attacks, and possibly evil maid attacks.
        pieterhg 13y ago
        When someone steals your device, you change your passwords and Google ends all active sessions automatically. If you use a session cookie from a very different location (e.g. another country, it also asks to re-enter the two-factor token. That leaves the chance of having your system being compromised through the internet. Sure, that's possible.
        zAy0LfpBZLC8mAC 13y ago
dredmorbius 13y ago
In an online world of ephermeralization (and applying good password hygiene), I don't see that as a particularly sound criticism. I don't make heavy use of online services, and yet I've got over 100 accounts I access (assessed by counting entries in my encrypted password store). Resetting those passwords (or even changing them, which might not be a bad idea) could easily take some time.
- mtrimpe 13y ago
  If only there were a collection of user scripts that would automate this task for you ...
  - Flimm 13y ago
    Is there one?
    - mtrimpe 13y ago
      Not that I know of...
  - dredmorbius 13y ago
    That is pretty much the epitome of "hard task". Sites differ, associating the right site with the right password is difficult, and the security risks (having scripts accidentally send the wrong creds to the wrong site(s)) mean you'd really want to get this right. In conjunction with some other thoughts of mine, though, this suggests a space for a more API-driven web design generally. One in which the authentication mode is clearly expressed. HTML had this integrated at one point with htaccess, but it was a horribly simplistic model. Something I've been thinking about.
    - Flimm 13y ago
      Mozilla Persona is a good start.
      - 13y ago

pieterhg 13y ago

You're spot on. That's a very good point. I guess I'm not a minimalist in the digital realm.

aestra 13y ago
I think you need a better system. Seriously, I just don't understand I guess I don't get it. I keep my browser on "forget everything on close" mode and I keep my passwords in a password manager all auto generated passwords. If I were to get robbed I would have to reset exactly zero passwords. Forgive me for being stupid, (I'm not trying yo be mean) but where you logged into every service you ever signed up for when you were robbed? Did you ever think to sign out after you were done? This is a personal preference, but I sign in, do my business, and then sign out after I'm done with the service.
- pieterhg 13y ago
  My main business is running a YouTube network so I'm signed into about 10 accounts in one browser session. Merely, to maintain my channels. All passwords are 16-character random strings with two-factor authentication enabled. So if I'd let my browser "forget everything on close" as you mention, that'd take even longer every morning to sign in to all these accounts. Opening up my password manager on my phone, then writing the 16-char password, then entering the two-factor auth code takes about a minute for each account. So that's 10 minutes to sign in to all those accounts. A bit too much for me to start my day with :) Then there's my personal email, my work email, my web server logins etc. It all adds up, that I'd rather save the sessions. But I agree, there's definitely space for some digital minimalism here :)
  - zAy0LfpBZLC8mAC 13y ago
    Well, I never thought it made much sense, but: What's the point of "two-factor", when the second factor isn't actually ever required? I mean, what is "two factor" about that setup?
    - pieterhg 13y ago
      Good point. Two-factor auth is required on any other browser session or device without the session cookie. It's also reset every 30 days, so you'll have to re-enter it even if you still have a session running.
      - zAy0LfpBZLC8mAC 13y ago
        Well, the first factor presumably is also required in order to get a new session cookie, so what's the point of the second factor there? And if someone breaks into your system, they'll have both your password and your session cookie, so they don't need the second factor either (well, except after 30 days after you have reinstalled your system, which I would think is plenty of time to abuse your account). Really, IMO two-factor authentication only makes sense where a separate challenge-response round is required for each transaction, so a replay of stolen credentials is impossible - as it's usually done with online banking. And against burglars, you can protect your cookies as well as your passwords by encrypting the disk contents. Just be aware of cold boot and DMA attacks, and possibly evil maid attacks.
        pieterhg 13y ago
        When someone steals your device, you change your passwords and Google ends all active sessions automatically. If you use a session cookie from a very different location (e.g. another country, it also asks to re-enter the two-factor token. That leaves the chance of having your system being compromised through the internet. Sure, that's possible.
        zAy0LfpBZLC8mAC 13y ago

dredmorbius 13y ago

In an online world of ephermeralization (and applying good password hygiene), I don't see that as a particularly sound criticism. I don't make heavy use of online services, and yet I've got over 100 accounts I access (assessed by counting entries in my encrypted password store). Resetting those passwords (or even changing them, which might not be a bad idea) could easily take some time.

mtrimpe 13y ago
If only there were a collection of user scripts that would automate this task for you ...
- Flimm 13y ago
  Is there one?
  - mtrimpe 13y ago
    Not that I know of...
- dredmorbius 13y ago
  That is pretty much the epitome of "hard task". Sites differ, associating the right site with the right password is difficult, and the security risks (having scripts accidentally send the wrong creds to the wrong site(s)) mean you'd really want to get this right. In conjunction with some other thoughts of mine, though, this suggests a space for a more API-driven web design generally. One in which the authentication mode is clearly expressed. HTML had this integrated at one point with htaccess, but it was a horribly simplistic model. Something I've been thinking about.
  - Flimm 13y ago
    Mozilla Persona is a good start.
    - 13y ago