Hacker News Reader

> Without compromising your security - I'd love to know how others approach their personal IT security challenges?

Most of my security is based on OpenPGP keys stored on a Yubikey. In case the first one is broken/lost I've got another one. If both are lost there is a master copy on an offline computer that can be used to provision more Yubikeys.

The key unlocks access to passwords stored in pass. Because pass is based on git and gpg can be used to access SSH then the same yubikey is used to pull/push changes to pass and read encrypted passwords. On both the laptop and the phone (Password Store).

Data on the computer is LUKS-encrypted, unlocked by the Yubikey. Full backup of my laptop's SSD is done via btrfs send/receive to a raid1 array of 3 disks (raid1c3) on a regular intervals. A small subset if very important data (documents) is also backed up via restic to S3 and Backblaze.

I try to "backup" as much of my work as possible by releasing it as open-source (where it's preserved by the Github etc.) or publishing it on a web-site (where it's preserved by archive.org).

> In a similar vein: what happens to my data after I die? How would my (non-technical) family be able to access my pictures and writings? A digital inheritance would be prevented in my security set if I don't prepare.

I've been thinking about this lately and maybe it's not a popular opinion but... would people really need your data when you die? I get access to photos (my SO has the PIN code) but everything else? Maybe this is just digital junk? Who would enjoy browsing terabytes of my data looking for... what exactly?

This sounds like my dream setup. Have you written about it somewhere in more detail or could you recommend some resources that you've used for implementing the solution?

Err, nope, this is a work-in-progress.

What are you especially interested in? Then I can provide you with details.

Some random links I used:

- https://btrfs.wiki.kernel.org/index.php/Incremental_Backup

- https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-...

- enable touch-to-use so even malicious software cannot access your passwords: https://developers.yubico.com/PGP/Card_edit.html#_yubikey_4_...

- https://www.passwordstore.org/

- https://play.google.com/store/apps/details?id=dev.msfjarvis....

- https://aur.archlinux.org/packages/mkinitcpio-gnupg/ (I'm thinking on replacing this with PKCS#11, more keys to manage but PKCS#11 is supported natively with systemd so one less dependency).

Hmm... maybe I should really document that...

> Most of my security is based on OpenPGP keys stored on a Yubikey. In case the first one is broken/lost I've got another one. If both are lost there is a master copy on an offline computer that can be used to provision more Yubikeys.

- https://blog.eleven-labs.com/en/openpgp-secret-keys-yubikey-...

Sounds like a good start, I'm going to have to do much more reading on this, I use my YubiKey just as a browser 2nd factor for a few 2FA apps.

In general I'm not sure how the YubiKey stores keys and till now I had no idea you can backup YubiKey

> The key unlocks access to passwords stored in pass. Because pass is based on git and gpg can be used to access SSH then the same yubikey is used to pull/push changes to pass and read encrypted passwords. On both the laptop and the phone (Password Store).

I'm not sure about storing the master keychein file in Git, but the workflow sounds interesting (I didn't fully understand the paragraph though).

> Data on the computer is LUKS-encrypted, unlocked by the Yubikey. Full backup of my laptop's SSD is done via btrfs send/receive to a raid1 array of 3 disks (raid1c3) on a regular intervals. A small subset if very important data (documents) is also backed up via restic to S3 and Backblaze.

This is next level and not of immediate interest to me. I was looking at something simpler like: https://cryptomator.org/

> In general I'm not sure how the YubiKey stores keys and till now I had no idea you can backup YubiKey

Well, actually you can't. You can backup keys if you create them in software and then just copy then to YubiKeys instead of moving them there. If you do that in an offline computer there is no risk of any malware stealing your keys in mid-process: https://news.ycombinator.com/item?id=21701488

Setting up Yubikey and OpenPGP took me some time reading all resources on the net but once done this is just working without any hiccups.

> I'm not sure about storing the master keychein file in Git, but the workflow sounds interesting (I didn't fully understand the paragraph though).

If it's encrypted there is no much harm to be done here. The only leaking info is that by default pass uses filenames based on domain names so if you have credentials for news.ycombinator.com they'd be in "news.ycombinator.com.gpg" file. For me a private repo for this use case is OK.

Oh, there is a browser extension too: https://github.com/browserpass/browserpass-extension#browser...

> This is next level and not of immediate interest to me. I was looking at something simpler like: https://cryptomator.org/

Yep, I do store external disk passwords in pass too. Udiskie can use a decryption command so when I put something like this in the config: `password_prompt: ["pass", "devices/{id_uuid}"]` it will grab the password from password store. This has an added benefit that I won't forget the password (it's stored alongside all others) and it's always valid (it's checked on each boot by udiskie).

People would leave with a low opinion of me if they could see everything I have stored and read.

:( I have set my gmail to be destroyed if not used for 3 months.

I wonder if you push your Password Store to GitHub? Its encryption is based on RSA with around 128 bits of security with current keys. It's unclear if it's going to stand beyond 2 decades.

I might be paranoid but with clouds I would be more comfortable with AES-256. If RSA is a must, maybe RSA 7680.

For the record there are quite a few new algos in GPG, most notably ed25519. While RSA 7680 offers 192 bits of security [0] ed25519 on the other hand is offering 128 bits of security. GnuPG 2.3 will have ed448/goldilocks available [2] and that should offer 224 bits of security [3] so in theory it should be better than RSA 7680.

I don't mind putting my encrypted passwords in a private GitHub repo but I understand the concern.

[0]: https://crypto.stackexchange.com/q/8687

[1]: https://en.wikipedia.org/wiki/Curve25519

[2]: https://lists.gnupg.org/pipermail/gnupg-users/2020-March/063...

[3]: https://en.wikipedia.org/wiki/Curve448

> losing my memory (my master passwords are only in my mind - what happens if suffer a head injury and forget?)

Not just a head injury, this can easily happen if you find your keychain 10 or 20 years later. I don't think that there is a good solution to it. Maybe biometric data, but then again, I want to have a control over when my data is accessed and in many countries it's legal for law enforcement to make you use your finger or face..

and fingers can easily be lost as well...

Maybe write down my master password and put it in a safe?

> Maybe write down my master password and put it in a safe?

Isn't this just moving the goalpost because what if you forget safe combination?

For a bank safe, you might access the vault with your id and a key. But I see what you mean. It's not perfect.

If the Youtube videos I've seen are to be believed then many domestic safes can be broken rather quickly with the right tools,

> what if you forget safe combination?

Safes with electronic locks typically have (backup) keys too, which you'd need to hide or put in another safe, in case the battery dies.

So, still moving goal posts?

Yes, just like a master password.

Not sure how pointing out that a safe has multiple methods of entry is moving goalposts.

If you write down your master password and put it in a safe you own you can get in that safe wether by code, key, or destructive entry.

Physical safes don't lock things the way cryptography does. You can always get in, especially if you're the legitimate owner because that way you don't need to worry about doing it in secret and not making a lot of noise.

> I don't think that there is a good solution to it.

There is. Put it on a piece of paper in a safe place.

How do you remember where you put the paper?

Start by not using Google Authenticator. It's outdated and has security vulnerabilities allowing malicious apps to extract your code. And it's impossible to backup without a rooted device. Anything that supports "Google Authenticator" really means any TOTP app is supprted, so for example andOTP on Android may be a good choice. Or you can use Authy or 1Password if you trust them.

thank you for the pointer to andOTP

- I need to migrate away from SMS based 2FA

- then away from Google Authenticator

- and probably also from LastPass to Bitwarden

https://getaegis.app/ This is great too on android https://twofactorauth.org/ Helps out finding how to set it up on certain sites

I had Google authenticator as 2FA.

Phone broke and I must have typo while doing a regular password change - now I have no way to again log into my account as i can't provide the 2FA and none of the other options work (providing old contact emails, phone code, backup email, ... All doesn't matter just because I don't have the authenticator).

Digital inheritance would make for a fascinating SaaS company if anyone could figure out the solutions to this.

Well. Maybe we should first handle data ownership

and closely related: the "digital graveyard", there's this Wired article of a guy who recorded his father and trained a voice model on his written communication [0]. A place to go if we want to be reminded of the voice, handwriting, face or attitude of a loved one. Faraway stone plates on crowded graveyards don't seem appealing to me in a world where families are often dispersed over the globe.

[0] https://www.wired.com/story/a-sons-race-to-give-his-dying-fa...

Tangentially, this reminds me a lot of an episode in Black Mirror:

https://en.m.wikipedia.org/wiki/Be_Right_Back

something like aegis is much better than googles authenticator. you can backup your keys and store them somewhere secure (veracrypt or whatever) and it also lets you choose a custom icons which makes it a bit easier to see what is what at a glance

I would first write down the master passwords, and store them somewhere safe.

It does not have to be fort knox safe, enough if stored at a trusted place which has no direct relation with you (in my case it is my best friend I trust with my life)