Hacker News Reader

Comment by FabHK | Hacker News Reader

Thanks for this, awesome. Questions:

> 4. Switch to Google Chrome.

Can one configure Chrome to not be a data-sucking kraken?

> 7. Disable cloud-based keychain backups.

That backup is encrypted, I'd hope? So, is the problem that getting hold of a cloud-backup facilitates off-line attacks on the encryption key?

I remember Filippo (FiloSottile here) publishing his encrypted private PGP key [1] (back when he was still positive on PGP). If that's safe, how is this problematic?

> 10. Install a password management application that doesn't store your secrets in the cloud.

Same question as 7. My understanding was that most password manager vulnerabilities have been related to browser integration, so that is the first thing I'd switch off.

[1] https://blog.filippo.io/on-keybase-dot-io-and-encrypted-priv...

View on HN

Regarding Chrome, here's a good place to start:

https://noncombatant.org/2014/03/11/privacy-and-security-set...

There are also people who use Chromium, or particular configurations of Chromium, instead of Chrome. That's fine. But don't use forks of Chromium, no matter who maintains them, even if it looks like a sizable effort. You don't want your browser to be any number of days behind the Chromium patch cycle.

I use the browser integration for 1Password on OS X (I might not if I was on Windows). I'm generally not that worried about localhost privilege escalation. I am very worried about how well I can reason about cloud-based storage of any sort, and how it will interact with things like my browser.

KISS: keep your secrets out of cloud systems and your backups offline.

If you're very sophisticated, I like Tarsnap for online backups. But you have to be very sophisticated to use it.

If you're very sophisticated, I like Tarsnap for online backups. But you have to be very sophisticated to use it.

I think you're overstating this a bit. You have to be comfortable at a UNIX command line. Surely that alone doesn't qualify someone as "very sophisticated"?

Yes, it very much does.

Very sophisticated varies on the demographics of the group, For HN no, for the general population yes.

Right, I can believe that. Maybe that's what tptacek meant.

>You don't want your browser to be any number of days behind the Chromium patch cycle.

Since Chromium does not upgrade itself, do you happen to have a suggestion on how to be arrange to be notified when a new patch is released?

> I am very worried about how well I can reason about cloud-based storage of any sort, and how it will interact with things like my browser.

In that case, why 1password over keepassx?

1Password doesn't store secrets in the cloud, as far as I know. You have to manually back up the database and some users choose to store that encrypted db in the cloud.

Reply on news.ycombinator.com