<html><head></head><body><div class="ydpdb406fbayahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div dir="ltr" data-setdir="false">Good point about writing down passwords.<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I have a different background than many of you. Currently I am only the sysadmin for my several personal computers, none is a server to the outside world. If this lock down continued for a lot longer I might have time to try setting that up. Oh wait, not long ago, Rick has having problems because the company providing his physical layer didn't want to offer static IP addresses and they also wanted to get rid of the 3rd party that offered static IP. <br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">The last time I had responsibility for a sizable system with multiple users was back before /etc/passwd was encrypted. That was not a problem because everyone who had access to the system worked on the same project. Time of innocence on the Internet.<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">I deal with passwords for the many financial and shopping accounts. They all have rules about character sets and so forth. Many of those business restrict log in attempts. I'm getting tired of looking at pictures with traffic lights.<br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"> Lately I am noticing more and more want to use my email for my login name. IMO, having somewhat unique log in names creates an extra difficulty for bad guys. <br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Just this morning Consumer Reports on TV gave the following advise about security. Their scenario was at the coffee shop with free WiFi. I think most of the following do not really apply, but I invite your comments.</div><div dir="ltr" data-setdir="false">1. Go to places that use a password to access the free WiFi. Duh, if someone goes to the effort to set up a bogus network with a confusingly similar name, why wouldn't they also use the password that is posted in the coffee shop?</div><div dir="ltr" data-setdir="false">2. Look for https. If the bogus network actually connects to my bank, wouldn't I get the same certs? How good is the encryption on the TSL, given that the network has been able to monitor all of the traffic that set up the connection? The encryption keys do need to be exchanged, yes?<br></div><div dir="ltr" data-setdir="false">3. Use VPN. Ah, I believe that VPN needs to be enabled at both ends. I haven't seen any evidence of VPN at my bank or Amazon.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div><br></div>
</div><div id="ydp7e7aa243yahoo_quoted_8206767013" class="ydp7e7aa243yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Saturday, April 18, 2020, 2:27:55 AM PDT, Nick Moffitt <nick@zork.net> wrote:
</div>
<div><br></div>
<div><br></div>
<div>On 17Apr2020 09:49pm (-0700), Tony Godshall wrote:<br clear="none">> On Thu, Apr 16, 2020 at 2:04 AM Nick Moffitt <<a shape="rect" href="mailto:nick@zork.net" rel="nofollow" target="_blank">nick@zork.net</a>> wrote:<br clear="none">> > PSA: Disable ssh password access, and keep a passphrase-locked private key<br clear="none">> > on portable media. This will prevent a number of "joe account" problems,<br clear="none">> > and simplify your threat model considerably.<br clear="none">> ...<br clear="none">> <br clear="none">> Someone with access to your keyfiles *would* be able to do a<br clear="none">> dictionary attack, since there's no rate-limiter on that.<br clear="none">> <br clear="none">> So preventing access to your private key on portable media becomes paramount.<br clear="none"><br clear="none">I would argue that this is a much simpler threat model in this day and age. We used to advise strongly that people never write down passwords, and that made a LOT of sense in the era of workstations in an office, where shoulder-surfing is a constant threat. But we then scolded our grandparents for writing down passwords in the privacy of their own homes, and I feel that that misunderstood the scope of the problem.<br clear="none"><br clear="none">I am currently far more worried about distributed armies of uncoordinated attackers throwing spaghetti at the walls of my systems to see what sticks than I am about targeted known-to-me attackers (with a few exceptions). So I keep my ssh keys in offline storage that is encrypted at rest, and load the keys into RAM by hand on boot.<br clear="none"><br clear="none">Even the exceptions to the category of attackers does not include people who have the resources to track me down physically and rob me in a way that would prevent me from contacting trusted parties to revoke my stolen credentials.<br clear="none"><br clear="none">If I were feeling like confounding pickpocket-hackers even more, I could employ Shamir sharing and shard my keys into multiple pieces for assembly at load time. I'm not sure the threat warrants that right now, and I'd be surprised if the benefits of such an approach outweighed the costs even under a persistent targeted threat.<div class="ydp7e7aa243yqt1442414733" id="ydp7e7aa243yqtfd19584"><br clear="none"><br clear="none">_______________________________________________<br clear="none">conspire mailing list<br clear="none"><a shape="rect" href="mailto:conspire@linuxmafia.com" rel="nofollow" target="_blank">conspire@linuxmafia.com</a><br clear="none"><a shape="rect" href="http://linuxmafia.com/mailman/listinfo/conspire" rel="nofollow" target="_blank">http://linuxmafia.com/mailman/listinfo/conspire</a><br clear="none"></div></div>
</div>
</div></body></html>