Hacker News Reader

Comment by doctoboggan | Hacker News Reader

I like the idea of this, however I do not like that you are expected to keep the master key in your drawer somewhere. It’s like writing your master password on a sticky note and putting it in a drawer.

I know there is always a risk of forgetting your master password but keeping it only in your brain gives you the most protection. I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key. However I am not a lawyer and would be interested to hear more from those who know more about this kind of situation.

View on HN

> It’s like writing your master password on a sticky note and putting it in a drawer.

People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers.

The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note.

Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box.

Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.

But you have to agree that memorizing your password is more secure than writing it down.

Of course. But not everyone is good at that.

correct battery horse staple, but longer and sensible but still unique, and optionally without space.

Make up a sentence that makes sense to you, and remove all the spaces, use all lowercase and no special characters.

Forgettable: 5uP3r53kr17P455w00r[)!!11One

Memorable: ilikestartrekandhamandbeans

I used to have full-disk encryption on one of my machines using a password of the forgettable kind. But then the machine had an uptime of months until a power outage, and I realized that while I was fairly sure of the sentence I had no possibility of remembering all of the uppercase and lowercase and symbol and number substitutions. I lost quite a bit of data that day.

After that I began using a sentence that makes sense to me but which is not from a book or anything like that for the FDE on my desktop and external hard drives, and I use the pass phrase frequently. Simplicity and repetition is the key to remember your master password.

As for websites I use a password manager, and I sometimes generate passwords with my own diceware software https://github.com/ctsrc/Pgen but most often I am on my phone or on my laptop and then I use the password generator of the password manager that comes with those Apple devices.

I haven’t lost any more data since switching to managing my data encryption and my passwords this way.

Encryption is a thing. If we can’t trust encrypted data then security the password is worthless anyway as everything is owned.

This is why password managers are generally considered secure. They store only client side encrypted blobs and do not store or know your master password.

Like you, I have no concerns with storing your master password on paper in a locked drawer or something, but it’s unrealistic to securely store post its for every password you need as well as have them readily accessible.

Readily accessible to you is readily accessible to hackers. People should re-evaluate how many things they must have access to everywhere they go.

For example, my 2FA tokens are backed up in physical storage. This means if I'm traveling and I lose my phone, I don't have access to them until I get back. But that's a lot safer than leaving them somewhere others can access them too.

Hackers don’t have quantum computers to crack my password vault.

I’m using 1Password and it encrypts the payloads before they are shipped to the cloud. How does that compromise my passwords?

This, of course, is the correct answer.

> I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key.

Yes, at least in the US. There's good case law backing up the legal doctrine that the 5th amendment applies concerning anything known or memorized -- but that with a warrant, law enforcement can search a premises and seize items described by the warrant.

IANAL, but one can still serve time (up to 18 months) for contempt of court as I understand it -

https://arstechnica.com/tech-policy/2020/02/man-who-refused-...

If you spill it on accident on your way to surrender it, it would be really unfortunate.

Unfortunately destruction of evidence is a crime which could aid the prosecutions arguments for consciousness of guilt and in the worth case tack on a new charge. I believe the jury could also be instructed to assume the worst in cases where evidence is destroyed.

Most unfortunate. :(

The current DiceKeys box has latches to make sure it's very very hard to open accidentally or if dropped from human heights.

We have thought about designing a box that's intentionally very easy to open for people who want to encrypt their laptop when traveling into a jurisdiction that may want to steal IP or compromise their journalistic sources. We'd want the user to be able to slip their hand into their pocket and release the dice from the box before anyone knows to ask for their DiceKey.

Reply on news.ycombinator.com