Hacker News Reader

Comment by causi | Hacker News Reader

It's almost comedic that the point of backups is to remove the single point of failure and then security paranoia creates new ones.

Perhaps what I should have done is stored all my backup codes and recovery keys on a USB stick and then given them to a friend?

If you're going to be that secure, put them on a USB stick and bury it in your yard or in the hollow of a tree. Easier to update and won't be destroyed when your house burns down.

View on HN

While I've yet to have this problem, I've actually been mentally keeping track of my ability to bootstrap back up. LastPass is trying to get me to add TOTP or other 2FA, but even though it promises (for now) that my master password can still get me in, I've resisted, because the password manager is my linchpin, and I need to be able to get in there just with "what I remember", and I don't want another way in where I'm not continually practicing that and keeping the memory fresh.

I also every so often take a backup of the LastPass DB and put it on my local Nextcloud, which get encrypted backup to S3 every night.

2FA is a lot less scary at work, where I have administrators and coworkers who can vouch for me face-to-face and reset it if necessary. I feel like there isn't a widespread understanding that personal authentication is a much harder problem than corporate authentication for that reason. It is easy to end up accidentally webbing together all your personal authentication until your current phone is your one and only token. Heck, with all the 2FA flying around now it's probably possible to get yourself into a situation where the only way to authenticate is using something else you're already authenticated to and you can't bootstrap back up if that expires unexpectedly. If we're not there we're getting close.

Another thing - flash storage that hasn't been powered up for a few years will probably have lost data. Better to get backup codes down on paper.

This happens. I've had SDCards sitting in devices long enough unpowered that they required a format when spun back up.

Large-capacity flash drives are very cheap; and you can write the same data (e.g. archive files) many times to the same drive to guard against some filesystem or file-level corruption.

There are also tools like par2(1) that can create parity recovery data for files; you could write those many times too.

My online backup solution that backs up the root filesystem for all of my machines generates a rolling tarball of that and then creates par2 recovery data for that tarball at 10% redundancy, and keeps 30 days of tarballs in addition to the current snapshot of the filesystem itself. This is because I store them on high-capacity spinning rust drives, which do have a small but non-zero data error rate.

Additionally, forensic tools like photorec(1) can recover these files even from severely damaged filesystems.

Then the only things you need to worry about are "device doesn't enumerate at all when I plug it in" and such. I'm sure you can have 2 devices side-by-side to mitigate that.

This obviously requires you to have a yard, which is probably not that common for city dwellers (even people renting houses shouldn't really be digging up their yard, and if you live in a duplex quadplex, you're sharing that yard with some number of neighbours of varying trustworthiness)

I wonder if you could just store a microSD card in a weather proof container taped or attached magnetically to the underside of a bench or other urban fixture. Place 5-6 of them for redundancy and keep them up to date.

I have my 1Password emergency kit, with the password filled in, stored on a water-sealed USB drive[1] which I store in a fire box in my house. The combo should mean, modulo a much hotter fire than most typical house fires, that when the fire department puts out the house I can just cut open the melted fire box and extract the very wet but still functional drive. I haven't tested this, of course, and I might take the above advice and put a second copy somewhere else.

[1]: https://www.corsair.com/us/en/Categories/Products/Storage/US...

I store them in Keepass files and then bury them/give to a friend/save in the cloud/whatever. It's just a single password that you remember, with no reliance on an external authenticator or like. And if someone finds your files, they're useless without the password.

If you store them on cloud, you should obviously do so on a service with no 2FA and a password you remember. The first priority is that you can access it anywhere and the main protection comes from the encrypted Keepass file.

Reply on news.ycombinator.com