Hacker News Reader

Comment by distortedsignal | Hacker News Reader

What do passwords do on an airgapped system?

Being serious - if the system is already not able to get anywhere, nobody needs to authenticate on it or with it. If you have passwords there, they don't _do_ anything.

I'm pretty security minded - the word "security" is in my job role - but my password vault is in Google Drive. I need to have it on many machines, and I want it to be backed up. I know my limits - I don't have the hardware and software infra and expertise that Google does - so I trust them with that data. Could it bite me? Yes, but it would require someone a) downloading my passwords file and b) decrypting it. That's enough steps that I'm confident that I'm safe enough.

View on HN

> What do passwords do on an airgapped system?

Get read and re-entered by exactly 1 person, the only person who's authorized to read them.

Oh, sorry, you wanted to copy and paste because you didn't think twice about the security of your clipboard, whether other userland programs are reading your memory? My bad.

> I'm pretty security minded - the word "security" is in my job role - but my password vault is in Google Drive.

I'm on a corporate red team. People like you with your mindset are why I have a job and why big breaches of F500's that "care about security" will always keep happening.

You don't prioritize security, you prioritize convenience, and security is a nice add-on to your convenience.

By all means, please continue doing things exactly as you do - my bank account and I will forever be grateful for folks like yourself. Never stop prioritizing your absolute convenience!

> Oh, sorry, you wanted to copy and paste because you didn't think twice about the security of your clipboard, whether other userland programs are reading your memory? My bad.

What do you do about keyloggers?

> People like you with your mindset are why I have a job and why big breaches of F500's that "care about security" will always keep happening.

And attitudes like this are what sours the relationship of regular users (who are not opposed to security but don’t consider achieving it their main objective) and the security/IT/… team of their company.

Provide users an actionable, practicable alternative to their existing insecure practice, or you haven't solved any problem. Ridiculing or belittling your user base doesn't help either.

Sorry, maybe I misstated.

This is a PERSONAL store. Not a corporate store. If this gets busted, I’m out a lot of money, but my company is very safe.

If you have expertise here, I’d be very interested. What is your backup and restore solution? How do you guarantee that your files are safe?

I’m still not sure that we’re using the same definition of “air-gapped” here. From my experience, and air-gapped system is one that is entirely off the network. Like you said, one user, but the system is gapped because there is something dangerous on it. Airgapped systems are used for research. The user should always have root privileges (they can’t mess anything up too badly, and if they do, image the machine or dispose of it in a fire or whatever) so… again, why passwords? What do they do? What do they protect?

> .. why passwords? What do they do? What do they protect?

They protect data/accounts on other machines. Similar to a piece of paper you'd write a password on but probably with added encryption, which would be difficult on paper.

Want to sign into account XY on the internet connected machine? Just look up the password (which might be a hard to remember sequence of characters) on the air gapped password machine.

Passwords on an airgapped system stay there where you type them across from that one to another one when you want to authenticate to something. Which, in this model, I suppose you have to do a lot, since obviously no one really security-minded would save a password in a browser. So I hope that airgapped machine isn't too heavy or can't run on batteries.

Password managers don't need gigabytes of memory, terabytes of storage, and a big, power-hungry x86 CPU. An air gapped machine doesn't necessarily imply a server, a desktop, or even a laptop.

Check out the mooltipass, onlykey, beamu, etc. There exist many such devices - some better than others. Note that this isn't an endorsement of the mentioned products, I just mention them as examples. Note also that not all of these devices constitute a true air-gap, though such devices which can display passwords without any kind of connection (be it bluetooth, usb, etc) can still meet that criteria.

Reply on news.ycombinator.com