Password paranoia
March 12, 2014 12:27 PM Subscribe
If one wanted to be paranoid about protecting access to critical accounts (bank accounts and the like) what are some steps that you can take short of building your own machine and never using it for any transactions at all other than those to the secure sites?
I have used lAstpass and 1 Password for years but frankly all of the recent revelations of security breaches and key loggers and the like make me wonder if I should consider other options for critical accounts (wondering out loud: is it not likely that the password app manufacturers were not NSA's first targets?)
Some accounts do not allow two step authentication.
Consider an open-source password manager (like KeePass) which at least has oversight.
Create a second partition on your machine or a VM that runs a "clean" OS that you could boot into for transactions?
posted by plinth at 1:02 PM on March 12, 2014
Create a second partition on your machine or a VM that runs a "clean" OS that you could boot into for transactions?
posted by plinth at 1:02 PM on March 12, 2014
For moderate-to-high paranoia:
Diceware to generate the passwords (memorize them, keep a copy somewhere safe if you want), and a second physical machine with a Live CD* in the drive and no hard drive, KVM switch between your machines. On your clean machine's CD image, you will want to have Firefox installed with HTTPS Everywhere, AdBlock, and NoScript addons to mitigate browser-based attacks (especially malicious ads)- even if they can't persist across boots, you don't want them.
* One that boots fast, not Ubuntu. Smaller is better since it's reading off the CD into memory.
posted by BungaDunga at 1:56 PM on March 12, 2014
Diceware to generate the passwords (memorize them, keep a copy somewhere safe if you want), and a second physical machine with a Live CD* in the drive and no hard drive, KVM switch between your machines. On your clean machine's CD image, you will want to have Firefox installed with HTTPS Everywhere, AdBlock, and NoScript addons to mitigate browser-based attacks (especially malicious ads)- even if they can't persist across boots, you don't want them.
* One that boots fast, not Ubuntu. Smaller is better since it's reading off the CD into memory.
posted by BungaDunga at 1:56 PM on March 12, 2014
Anything you put on a computer is potentially vulnerable. For example, even if you encrypt locally and store locally, or even on a USB drive, if your computer has been compromised, someone could potentially get the information.
And if your computer is compromised, then even if you don't store passwords on your computer or in the cloud and instead keep them in your head or on paper, someone could still get them while you are typing them.
If you keep things on paper, you not only still have risk on the computer but you also risk losing them or someone stealing them.
A tool like LastPass allows you to still have convenience and at the same time good security in that you can use complex and unique passwords on each website you use. If a website's security is breached, your complex and unique password may be more secure than someone else's weak password or used-everywhere password and your vulnerability is limited to that one site. So using LastPass is not a bad solution. You still have the risk of your own computer being compromised and therefore your LastPass account being compromised, and you still have the risk of LastPass' servers being compromised, but since they are experts and apparently reputable and experienced, the chance of their servers being compromised, even though they are a juicy target, may be less than the chance of your own storage methods being compromised.
I think LastPass also monitors their servers pretty carefully and it's likely (but by no means certain) you would be notified if there was a breach (as happened in the past) and you could quickly change all your passwords.
Not sure what you mean about sites not allowing two factor authentication. As far as I know, LastPass itself enforces any two factor authentication process you have set up. I think two factor authentication is of limited use - it helps with some aspects of security but not with other aspects.
In my opinion, the benefits of using LastPass outweigh the risks. But other people may disagree.
posted by Dansaman at 2:42 PM on March 12, 2014
And if your computer is compromised, then even if you don't store passwords on your computer or in the cloud and instead keep them in your head or on paper, someone could still get them while you are typing them.
If you keep things on paper, you not only still have risk on the computer but you also risk losing them or someone stealing them.
A tool like LastPass allows you to still have convenience and at the same time good security in that you can use complex and unique passwords on each website you use. If a website's security is breached, your complex and unique password may be more secure than someone else's weak password or used-everywhere password and your vulnerability is limited to that one site. So using LastPass is not a bad solution. You still have the risk of your own computer being compromised and therefore your LastPass account being compromised, and you still have the risk of LastPass' servers being compromised, but since they are experts and apparently reputable and experienced, the chance of their servers being compromised, even though they are a juicy target, may be less than the chance of your own storage methods being compromised.
I think LastPass also monitors their servers pretty carefully and it's likely (but by no means certain) you would be notified if there was a breach (as happened in the past) and you could quickly change all your passwords.
Not sure what you mean about sites not allowing two factor authentication. As far as I know, LastPass itself enforces any two factor authentication process you have set up. I think two factor authentication is of limited use - it helps with some aspects of security but not with other aspects.
In my opinion, the benefits of using LastPass outweigh the risks. But other people may disagree.
posted by Dansaman at 2:42 PM on March 12, 2014
Response by poster: Last pass with 2 step surely better than without ?
posted by dougiedd at 6:59 PM on March 12, 2014
posted by dougiedd at 6:59 PM on March 12, 2014
It depends on your level of paranoia.
Adding 2 factor to lastpass is easy to do and provides some protection.
Having a machine which you only use for accessing secure info may help some, especially if it's an uncommon OS.
Booting off a read-only media with a known-good OS and browser is the next level. If you're really paranoid verifying that the OS and browser don't have some hidden backdoor, keylogger or other nefarious add-in could be difficult.
Next is to protect yourself from people reading the contents of your monitor remotely (van-eck phreaking). You'd have to get some sort of shielding system.
You would also want to use a shielded, wired connection to the internet. Wifi probably isn't all that secure.
These are all things you can do on your side of the equation. Unfortunately there isn't much you can do about the data once it leaves your local network. There are stories about the NSA gathering data at central locations on the Internet. It may be that they intentionally weakened encryption standards to make it easier for them to decrypt.
Then there is the security of whatever websites and services you're using. Security is frankly a pain to implement and it requires eternal vigilance, so many companies are sloppy. I imagine banks are probably better about such things given the money involved, but I don't know.
If you are dealing with a bank or other service directly involved with money and they do not support two factor authentication, I recommend switching to another. Strong passwords help, but not in all scenarios.
On a related note, it kind of amazes me that mint.com doesn't support two factor. They want you to give it your login/password to all your bank accounts, but they don't put much effort into security? Crazy.
Anyway, add two factor everywhere possible. It's not perfect but it makes you a bit more secure.
posted by DrumsIntheDeep at 8:16 PM on March 12, 2014
Adding 2 factor to lastpass is easy to do and provides some protection.
Having a machine which you only use for accessing secure info may help some, especially if it's an uncommon OS.
Booting off a read-only media with a known-good OS and browser is the next level. If you're really paranoid verifying that the OS and browser don't have some hidden backdoor, keylogger or other nefarious add-in could be difficult.
Next is to protect yourself from people reading the contents of your monitor remotely (van-eck phreaking). You'd have to get some sort of shielding system.
You would also want to use a shielded, wired connection to the internet. Wifi probably isn't all that secure.
These are all things you can do on your side of the equation. Unfortunately there isn't much you can do about the data once it leaves your local network. There are stories about the NSA gathering data at central locations on the Internet. It may be that they intentionally weakened encryption standards to make it easier for them to decrypt.
Then there is the security of whatever websites and services you're using. Security is frankly a pain to implement and it requires eternal vigilance, so many companies are sloppy. I imagine banks are probably better about such things given the money involved, but I don't know.
If you are dealing with a bank or other service directly involved with money and they do not support two factor authentication, I recommend switching to another. Strong passwords help, but not in all scenarios.
On a related note, it kind of amazes me that mint.com doesn't support two factor. They want you to give it your login/password to all your bank accounts, but they don't put much effort into security? Crazy.
Anyway, add two factor everywhere possible. It's not perfect but it makes you a bit more secure.
posted by DrumsIntheDeep at 8:16 PM on March 12, 2014
Another thing to consider is that all these efforts focused on protecting the password will be for nothing if whatever account the password is for allows for password reset by email and the particular email address you have on file for that account gets compromised.
posted by radwolf76 at 11:07 PM on March 12, 2014
posted by radwolf76 at 11:07 PM on March 12, 2014
Keyloggers undermine all of this except 2-factor. So there's that.....
posted by lalochezia at 7:28 AM on March 13, 2014
posted by lalochezia at 7:28 AM on March 13, 2014
« Older Smart phones with a physical keyboard | I make $25/hour and keep thinking I could do... Newer »
This thread is closed to new comments.
posted by Green With You at 12:33 PM on March 12, 2014