Hacker News Reader

Comment by benjohnson | Hacker News Reader

We swiped an idea from launching Nuclear Missiles: Typically you need two keys from two people to launch.

For really important accounts - we have three people who each know two thirds of the password. It requires two people to then log in and do damage.

For example if the root password was CatDogFish then

Person1: CatDog_

Person2: _DogFish

Person3: Cat_Fish

Two people can then log in and watch what the other person is doing.

View on HN

This is like an informal version of Shamir's Secret Sharing

https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

Maybe someone should implement a PAM module or something that requires authenticating as two different users with sudo privileges, so you can implement this for as many users as you like and let them each have a single password, instead of half of a password for each possible pair of users.

If would also have to do session sharing so both people can watch each other and see what commands they run.

Use something with 2FA like e.g. https://duo.com/docs/duounix and give person A the password and person B the 2nd factor (phone with this Duo profile configured or whatever).

That doesn't eliminate the need to set up an account & password for every possible pair of users, rather than just every user.

What if one of the people that has part of the key gets mad and leaves without sharing it?

Then you still have two users with a complete password set, from which you can either reconstruct the third permutation or generate a new set.

https://blog.threatstack.com/who-watches-the-watchmen-securi... // https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%... this idea has been around for a very long time.

That only sort of helps. Do both people also watch each other while they run commands?

Because if not, once you are admin, you can install programs that let you become admin again at will.

Yes! We swiped the idea from the military. In certain dangerous places, they require two people to be there or nobody. One person is not allowed.

https://en.wikipedia.org/wiki/Two-man_rule

Well whoever set that up knows the whole password right?

Nope. It could be system generated and disseminated over secure channels.

Password rotation becomes necessary, and a little bit riskier, because now you have to deal with accidental lock-outs in a sane, coordinated manner.

and who implements the system that generates and disseminates over secure channel?

You are stuck trusting somebody, no matter what. Its turtles all the way down.

Eh, 3 pieces of a randomly generated string... hashed in memory, and only the result of the hash function is stored. Pretty basic concept.

Soon, dear throwaway, you'll be telling me we should live in fear of the locksmiths, for all their key blanks and such fiendish metal files to abrade them with. What if they should file down a butter knife into the shape of my precious bicycle chain's key?

I didn't say you should be afraid, simply that trying to build a system that doesn't require you to trust people is a fools errand.

So one person runs a keylogger and captures the full credentials?

But it's not a bad system.

Reply on news.ycombinator.com