Comment by inetknght | Hacker News Reader

Comment by inetknght | Hacker News Reader

Parent Full thread

1) Use password manager

2) get asked to help someone else at their machine

3) need to log-in to a remote resource under my own user to do something

4) password is in the password manager on my workstation on another floor

Solution? Should I:

* ask the person to give very exact and detailed instructions on what they need me to accomplish so that I can do that work from my own workstation?

* go up to my workstation and call the person who needs help and walk him through logging in as me?

* remote-login from their workstation to mine to copy/paste (and hope their workstation's clipboard is secure)?

* bring my password manager with me on my phone (and risk my passwords being pwned because phones are Not Secure)?

* write down 40 character password somewhere (stick-it note?) and hope I neither typo anything, nor allow others to read it, nor carelessly discard it?

* just use a password I made up and can easily remember?

I'm sure there's better solutions. Each one has their own annoyances.

> * bring my password manager with me on my phone (and risk my passwords being pwned because phones are Not Secure)?

As someone who uses this solution to your above-stated problem, I disagree with the assertion that phones are "Not Secure." Care to back that up?

Physical device small enough to be quickly stolen: Not Secure. (this is self-evident: physical access to device is Game Over)

Low battery requires plugging in a cable to charge; the cable may be a surreptitiously-installed data cable. I do not trust the hardware or software stack that handles the data cable to be secure.

SMS: Not Secure. http://www.cybersecuritytrend.com/topics/cyber-security/arti...

Wifi: Not Secure. https://www.bestvpn.com/privacy-news/wpa2-wifi-not-secure/

Many apps "require" silly amounts of permissions to the phone before they'll install. Apps' ability to read what's on screen, to be notified of clipboard changes, to listen to sounds; all when not even in the foreground. On my computer, I can easily check what apps and background services are running. Not so easily on a phone.

> On my computer, I can easily check what apps and background services are running.

Did you audit the Intel AME, HD firmware, chipset, audio drivers, usb drivers, and everything else on your PC?

(this is self-evident: physical access to device is Game Over)

This is just totally not true.

I'd wager a fair sum that passwords stored on an iPhone, behind a decent layer of security, are entirely better protected from physical access than on any general-purpose computer.

Passwords stored on a general purpose computer, behind a decent layer of security, are entirely better protected from physical access than on any phone I've ever used.

Yeah, the FBI totally breezed through the whole iPhone unlock thing. /sarcasm

Where do I even start? I think it would be easier for you to tell me why you think phones are secure and then I tell you why you're wrong.

Copy/paste the needed password from your workstation to a text file on a secure USB key, then use the key to copy/paste it into the login on the other workstation and delete the file.

> * remote-login from their workstation to mine to copy/paste (and hope their workstation's clipboard is secure)?

This option also risks leaving around credentials to remote-login to your workstation.

No sense worrying about the workstation's clipboard-security though- if the workstation itself is pwned or intentionally bugged, the password will be at risk from a keylogger or network-sniffing proxy when it's typed in anyway, so no avoiding that risk.

Option B is to ask yourself whether a 40-character impossible-to-write-down-without-typos password, phones are Not Secure level of security-paranoia is worth the tradeoff of inconvenience (it may be, depending on the nature of your work).

All good points.

FWIW I currently write software which analyzes DNA; privacy and medical issues are real and definite concerns to me.

If I anticipated such action could occur, I would use an "X random words" passphrase pattern.

It's long, it's random, you don't have to look at it, and is easily communicated to someone.

Heck, I do the same for answers to security questions in case I need to communicate an answer to it for whatever reason.

Reply on news.ycombinator.com