| Sysop: | Amessyroom |
|---|---|
| Location: | Fayetteville, NC |
| Users: | 43 |
| Nodes: | 6 (0 / 6) |
| Uptime: | 95:32:20 |
| Calls: | 290 |
| Files: | 904 |
| Messages: | 76,423 |
my mother is currently struggling to memorize all of my dead
stepfather's identities and passwords and that makes me wonder how
would you like an internet of hosts who store everything undeletably
and barrierlessly readably with no secrets whatsoever to humanity nor
any other natural or artificial or divine intelligence? i know this
sounds like a question for debian-devel or debian-policy but i m
dumping it onto debian-user as as of now i m not subscribed to any
other.
On Mon, Dec 16, 2024 at 2:42鈥疉M 馃 <czyborra@gmail.com> wrote:passwordlessness.
YubiKeys is a password manager in a dongle, thus the exact opposite of passwordless. Your dogs and your goats are passwordless, they reliably serve you but have a built in immune system with redundancies protecting them from abuses of their
You don't understand YubiKeys
Why does your mother need to memorize all of your dead stepfather's identities? Just let them die with him.
perhaps because the accounts are jointly owned and it is much easier
to just continue using the credentials as they exist instead of having
to set everything up all over again for no real gain.
songbird writes:
perhaps because the accounts are jointly owned and it is much easier
to just continue using the credentials as they exist instead of having
to set everything up all over again for no real gain.
Then follow Bruce Schneier's advice and*write them down*.
<tomas@tuxteam.de> writes:
On Mon, Dec 16, 2024 at 10:22:43PM -0600, John Hasler wrote:
songbird writes:
perhaps because the accounts are jointly owned and it is much easier
to just continue using the credentials as they exist instead of having >> > to set everything up all over again for no real gain.
Then follow Bruce Schneier's advice and*write them down*.
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice, too). Seeing what Schneier has to say on that would be very interesting.
I have a German copy of "Secrets & Lies" from 2001 in which Schneier discusses writing passwords down on p. 138 (Chapter 9 "Identification
and Authentication, Section "Access Tokens"). He says that passwords
are no worse than other "simple tokens" (anything which can be stolen or copied) but if you write them down, keeping them in your wallet can be
safer than sticking them with a post-it to you monitor. His actual
advice is that you should only write half your password down and commit
the other half to memory.
On Mon, Dec 16, 2024 at 10:22:43PM -0600, John Hasler wrote:
songbird writes:
perhaps because the accounts are jointly owned and it is much easier
to just continue using the credentials as they exist instead of having
to set everything up all over again for no real gain.
Then follow Bruce Schneier's advice and*write them down*.
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice, too). Seeing what Schneier has to say on that would be very interesting.
debian-user@howorth.org.uk wrote:
...
Why does your mother need to memorize all of your dead stepfather's identities? Just let them die with him.
perhaps because the accounts are jointly owned and it
is much easier to just continue using the credentials as
they exist instead of having to set everything up all
over again for no real gain.
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice, >too). Seeing what Schneier has to say on that would be very interesting.
On Tue, Dec 17, 2024 at 06:45:05AM +0100, tomas@tuxteam.de wrote:
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice, too). Seeing what Schneier has to say on that would be very interesting.
All of this advice is overly simplistic. The right answer depends on understanding your threats and making a conscious decision what risks you want to mitigate [...]
Then follow Bruce Schneier's advice and*write them down*.
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice, too). Seeing what Schneier has to say on that would be very interesting.
On Tue, Dec 17, 2024 at 12:29鈥疨M <tomas@tuxteam.de> wrote:
On Tue, Dec 17, 2024 at 10:59:40AM -0500, Michael Stone wrote:
On Tue, Dec 17, 2024 at 06:45:05AM +0100, tomas@tuxteam.de wrote:
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice,
too). Seeing what Schneier has to say on that would be very interesting.
All of this advice is overly simplistic. The right answer depends on understanding your threats and making a conscious decision what risks you want to mitigate [...]
I know, I know. My introductory sentence is almost literally yours.
As times shift, threat models shift accordingly. Back then, when
computers and environments were more shared, post-its and shoulder
surfing were the main password leak threat, in-between it was the
(clear text) transport, these days it's probably phishing and
server-side breaches, which -- hopefully! -- yield a database of
salted hashes, in which case strong passwords are vital.
I'm still very interested in those references, not to follow them
blindly, but because they may contain insights I haven't had myself. Especially in the case of Schneier, I'm doubly eager to listen.
Schneier is security on training wheels. (Not to impune his work). It
is a good introduction, but it is written for a different audience.
If you really want to satisfy your security related hunger, then read Gutmann's Engineering Security[1] or Ross Anderson's Security
Engineering.[2] I prefer Gutmann because it is so well cited. I often
pull the cited papers and read them for myself.
On 17 Dec 2024 06:45 +0100, from tomas@tuxteam.de:
Then follow Bruce Schneier's advice and*write them down*.
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my advice,
too). Seeing what Schneier has to say on that would be very interesting.
Not Schneier, but consider also the UK National Cyber Security
Centre's position on password managers: https://www.ncsc.gov.uk/blog-post/what-does-ncsc-think-password-managers
Under the heading "Should I use a password manager?" the opening is:
"Yes. Password managers are a good thing. They give you huge
advantages in a world where there's far too many passwords for anyone
to remember."
Under the heading "Should I use a password manager?" the opening is:
"Yes. Password managers are a good thing. They give you huge
advantages in a world where there's far too many passwords for anyone
to remember."
the nonsense about about not changing them ignores the obvious.
My bank performs security checks by requesting a sub-set of my
password.
On 17 Dec 2024 06:45 +0100, from tomas@tuxteam.de:
Then follow Bruce Schneier's advice and*write them down*.
Do you have a reference?
I ask because I'm in the middle of a discussion (and that was my
advice, too). Seeing what Schneier has to say on that would be very interesting.
Not Schneier, but consider also the UK National Cyber Security
Centre's position on password managers: https://www.ncsc.gov.uk/blog-post/what-does-ncsc-think-password-managers
Under the heading "Should I use a password manager?" the opening is:
"Yes. Password managers are a good thing. They give you huge
advantages in a world where there's far too many passwords for anyone
to remember."
On 17 Dec 2024 21:41 -0600, from deblis@lionunicorn.co.uk (David Wright):
As you have to select the subset from some listboxes with a mouse,
I would guess that the step is designed to defeat key-logging.
If someone has maliciously installed a keylogger, there's also likely
some kind of screen recording software, so this seems like security
theater.
As you have to select the subset from some listboxes with a mouse,
I would guess that the step is designed to defeat key-logging.
When doing "security analysis", I tend to lump "compromised client"
into one category.
Simply sharing a password method I was taught years ago that works well. Granted I never allow anything to choose a password for me, not ever. Instead I create a sentence with aspects of the characters forming the password.
As an example, I will create one, not in use of course, for the below sentence.
in 2012 I joined the Debian list.
Again everything above is likely untrue, still it becomes the following. ItlI#10t4l
[/snip description/]
As I note on https://michael.kjorling.se/password-tips/ (constructive criticism most welcome!) "someone who has perfect knowledge of you
should not have any advantage in guessing the password".
Michael Kj枚rling <c9bc136c6063@ewoof.net> wrote:
On 17 Dec 2024 21:41 -0600, from deblis@lionunicorn.co.uk (David Wright):
As you have to select the subset from some listboxes with a mouse,
I would guess that the step is designed to defeat key-logging.
If someone has maliciously installed a keylogger, there's also likely
some kind of screen recording software, so this seems like security theater.
Yes, I think things like key loggers or even simple 'shoulder surfing'
are the commonest ways of passwords being 'broken'.
Surely no one "has perfect knowledge of you"! :-) I'm not even sure I
have perfect knowledge of myself, in fact I'm pretty sure I don't!
Surely no one "has perfect knowledge of you"! :-) I'm not even sure I
have perfect knowledge of myself, in fact I'm pretty sure I don't!
But which things about you can you be sure no one else has knowledge of?
Most people seem to think that the name of the dog they had when they
were 12 is an unguessable secret.
I *could* share my strategies for coming up with passwords.
On 18 Dec 2024 11:57 -0600, from john@sugarbit.com (John Hasler):
Surely no one "has perfect knowledge of you"! :-) I'm not even sure I
have perfect knowledge of myself, in fact I'm pretty sure I don't!
But which things about you can you be sure no one else has knowledge of? Most people seem to think that the name of the dog they had when they
were 12 is an unguessable secret.
Pretty much. Or the phone number you had at home as a child. Or your
favorite color. Or your mother's maiden name. Or that you have used
Debian since year Y. Or which year your great-grandmother died.
If I generate a Diceware passphrase - let's take one from that page as
an example, "dean unissued mystified comfort everyday chokehold" -
then I can tell you exactly how I generated it and what the inputs
were ("6 words selected at random out of the EFF English long Diceware
word list, separated by single U+0020 space characters") and this
won't really help you, because the search space is still (6^5)^6 or
about 2^77.
Chris Green writes:
Surely no one "has perfect knowledge of you"! :-) I'm not even sure I
have perfect knowledge of myself, in fact I'm pretty sure I don't!
But which things about you can you be sure no one else has knowledge of?
Most people seem to think that the name of the dog they had when they
were 12 is an unguessable secret.
Sent: Wednesday, December 18, 2024 at 2:04 PM
From: "John Hasler" <john@sugarbit.com>
To: debian-user@lists.debian.org
Subject: Re: Writing passwords down
JHHL writes:
I *could* share my strategies for coming up with passwords.
Mine is pwgen -s 12
But which things about you can you be sure no one else has knowledge of?
Most people seem to think that the name of the dog they had when they
were 12 is an unguessable secret.
That depends rather on how long ago they were 12 surely.
On 17 Dec 2024 23:42 -0500, from klewellen@shellworld.net (Karen Lewellen):
Simply sharing a password method I was taught years ago that works well.
Granted I never allow anything to choose a password for me, not ever.
Instead I create a sentence with aspects of the characters forming the
password.
As an example, I will create one, not in use of course, for the below
sentence.
in 2012 I joined the Debian list.
Again everything above is likely untrue, still it becomes the following.
ItlI#10t4l
[/snip description/]
This method would seem to fail at generating randomness, because it's
based on an initial meaningful sentence (keeping in mind that natural language has very low entropy; consider that in your example, "joined"
is much more likely in that position than, say, "aardvark", "vibrated"
or "swordsman") plus some relatively fixed, predetermined
transformations.
It also requires you to remember which sentence you used as the seed
for which service. That might work for a few services, but does it
scale into the hundreds or thousands?
Thus xkcd 936 essentially applies. https://xkcd.com/936/
As I note on https://michael.kjorling.se/password-tips/ (constructive criticism most welcome!) "someone who has perfect knowledge of you
should not have any advantage in guessing the password".
The two main ways of meeting that criteria (which is not the only one,
but is the one which is pertinent here) is random out of a character
set, and Diceware with words selected at random. The former gives a
high degree of security for a given length, and the latter gives good memorability. The work factor of a password or passphrase generated
using either method can be objectively quantified.
And humans in general are terrible at randomness.
--
Michael Kj枚rling
馃敆聽https://michael.kjorling.se
Karen writes:
Well, I do not use hundreds. Still that little black book is,
speaking personally, far safer to my mind then any digital solution.
If you are going to use a little black book why not just use random passwords? pwgen -s 10 and write it down.
And if they insist on a "password recovery secret" give them a random
string for that as well.
--
John Hasler
john@sugarbit.com
Elmwood, WI USA
Michael Kj枚rling <c9bc136c6063@ewoof.net> wrote:
Surely no one "has perfect knowledge of you"! :-) I'm not even sure I
As I note on https://michael.kjorling.se/password-tips/ (constructive
criticism most welcome!) "someone who has perfect knowledge of you
should not have any advantage in guessing the password".
have perfect knowledge of myself, in fact I'm pretty sure I don't!
--
Chris Green
路
Well, I do not use hundreds. Still that little black book is,
speaking personally, far safer to my mind then any digital solution.
Michael Kj枚rling <c9bc136c6063@ewoof.net> wrote:
If I generate a Diceware passphrase - let's take one from that page as
an example, "dean unissued mystified comfort everyday chokehold" -
But how do you remember it? It's no more memorable than a string of
numbers, in fact I find numbers easier to remember than words.
Karen writes:
Well, I do not use hundreds. Still that little black book is,
speaking personally, far safer to my mind then any digital solution.
If you are going to use a little black book why not just use random passwords? pwgen -s 10 and write it down.
John Hasler <john@sugarbit.com> wrote:
Karen writes:
Well, I do not use hundreds. Still that little black book is,
speaking personally, far safer to my mind then any digital
solution.
If you are going to use a little black book why not just use random passwords? pwgen -s 10 and write it down.
Because a long series of random characters is incredibly difficult to
type accurately!
Horses for courses, I enter login passwords/passphrases quite
frequently (lots of different systems that I ssh to) long,
unmemorable, passwords would be useless.
For the odd password that needs to be **extra** secure I suppose I
could use a written down password.
On 19/12/2024 15:56, Chris Green wrote:
Horses for courses, I enter login passwords/passphrases quite frequently (lots of
different systems that I ssh to) long, unmemorable, passwords would be useless.
Generate a private key and add its public counterpart to ~/.ssh/authorized_keys on remote machines. Locally running ssh-agent
allows to authenticate on remote machines without typing the pass phrase
for the private key for each connection. It is more secure than
passwords against brute force attacks.
(You may have more than one private key and may configure ssh to use
some key for specific set of servers.)
On 19/12/2024 15:56, Chris Green wrote:
Horses for courses, I enter login passwords/passphrases quite frequently (lots of
different systems that I ssh to) long, unmemorable, passwords would be useless.
Generate a private key and add its public counterpart to ~/.ssh/authorized_keys on remote machines. Locally running ssh-agent allows to authenticate on remote machines without typing the pass phrase for the private key for each connection. It is more secure than passwords against brute force attacks.
On 19/12/2024 15:56, Chris Green wrote:
Horses for courses, I enter login passwords/passphrases quite frequently (lots of
different systems that I ssh to) long, unmemorable, passwords would be useless.
Generate a private key and add its public counterpart to ~/.ssh/authorized_keys on remote machines. Locally running ssh-agent
allows to authenticate on remote machines without typing the pass phrase
for the private key for each connection. It is more secure than
passwords against brute force attacks.
[-- text/plain, encoding quoted-printable, charset: utf-8, 24 lines --]
On Fri, Dec 20, 2024 at 10:22:29AM +0700, Max Nikulin wrote:
On 19/12/2024 15:56, Chris Green wrote:
Horses for courses, I enter login passwords/passphrases quite frequently (lots of
different systems that I ssh to) long, unmemorable, passwords would be useless.
Generate a private key and add its public counterpart to ~/.ssh/authorized_keys on remote machines. Locally running ssh-agent allows to authenticate on remote machines without typing the pass phrase for the private key for each connection. It is more secure than passwords against brute force attacks.
Definitely. I was thinking specifically about passwords: what they are, how they work. But it's clear that (asymmetric) crypto keys are worlds ahead
of passwords in terms of security, convenience (agent forwarding, anyone?) LDAP integration and all of that. Whenever I have the choice, a SSH key it is.
tomas@tuxteam.de wrote:
[-- text/plain, encoding quoted-printable, charset: utf-8, 24 lines --]
On Fri, Dec 20, 2024 at 10:22:29AM +0700, Max Nikulin wrote:
On 19/12/2024 15:56, Chris Green wrote:
Horses for courses, I enter login passwords/passphrases quite frequently (lots of
different systems that I ssh to) long, unmemorable, passwords would be useless.
Generate a private key and add its public counterpart to ~/.ssh/authorized_keys on remote machines. Locally running ssh-agent allows
to authenticate on remote machines without typing the pass phrase for the private key for each connection. It is more secure than passwords against brute force attacks.
Definitely. I was thinking specifically about passwords: what they are, how they work. But it's clear that (asymmetric) crypto keys are worlds ahead
of passwords in terms of security, convenience (agent forwarding, anyone?) LDAP integration and all of that. Whenever I have the choice, a SSH key it is.
WHY????
It depends very much on the way your connection might get attacked. A
key based ssh connection is (as you say) much more secure against
attacks directly on the remote server, but only if that remote server
has password login disabled. Your key based login is quite irrelevant
if there's actually a password that the intruder can guess.
At the local end using a passphrase protected ssh key is no better
than a password, both depend entirely on how easy the password or
passphrase can be guessed. In fact my feeling is that password is
slightly better because if you are using ssh-agent as you may well
leave your system for short periods without logging off and then an
intruder will be able to log in to all those remote systems for which ssh-agent has saved your key(s). (Physical security again!) This last
is why I have my ssh-agent set to expire keys after a few minutes.
--
Chris Green
路