The DMZ

« first day (2118 days earlier) ← previous day next day → last day (3060 days later) »

Rоry McCune

09:27

@WhiteWinterWolf well TBH for a lot of users, writing down passwords in a book that you store securely in your house (e.g. a locked drawer) would be a lot better for their overall Internet security than the alternative approach of using the same small set of passwords across many sites

@O'Niel OpenVAS/Nessus/Nexpose all have different strength and weaknesses from last time I did a comparison. My personal preference is Nessus, but all of them have their merits

3 hours later…

Anders

12:15

After a couple of help-my-pc-has-a-virus-questions popped up in the flow, I got around to writing an attempt at a canonical quesiton (as discussed previously on meta). Would be really nice for us if we could quickly close such questions, and really nice for the OP's if we could do it by linking to a good duplicate.

Q: Help! My home PC has been infected by a virus! What do I do now?

This is an attempt to ask a canonical quesiton as discussed in this old meta post. The goal is to create something helpful that can be used as a duplicate when non experts ask about virus infections. Let's say that I have determined beyond doubt that my home PC is infected by a virus. If ne...

Stack Exchange

12:57

Despite it being imaginary, I already have SUCH a strong opinion on the cord-switch firing incident.

WhiteWinterWolf

13:47

@RоryMcCune I agree as long as the user resists to the temptation to bring it in his bag for instance to be able to access usual websites both from home and from work (even more if the cellphone and/or credit card PIN are written in it: same concept as storing the card or token used to boot the laptop in the laptop suitcase ;) ).

M'vy

Why do you say this? in case of loss? or theft?

Cause I'm pretty sure the probability of theft / loss would not amount the the probability of being hacked cause of a too weak password

It obviously makes it easier for someone with physical access. But in that case, it's arguably better than being compelled to give your password (most probably by threat or violence)

WhiteWinterWolf

@RоryMcCune As long as it remains stored at home (but I would expect such advise to be written as a short introduction in the book), the concept can make sense but I would also be happy to see some diceware-like password generation method (for instance letters in random order at the page footer, so selecting a few random pages would allow to easily create truly random passwords instead of using variation around comics characters names for instance).

Stack Exchange

Stack Overflow Podcast #89 - The Decline of Stack Overflow Has Been Greatly Exaggerated

Jess Pardue on October 3, 2016

Welcome to The Stack Overflow (yes Overflow, listen to last week!) Podcast #89, recorded September 27 at Stack Overflow headquarters in NYC. This week's installment is brought to you by Inuktitut, the premiere language of the arctic and one of Nunavut's three official languages (Umiaryuap Publimaaqpaga tattaurniq ammayaq!) as well as National Voter Registration Day. Go to www.voteplz.org for the easiest way to register! "Every individual regardless of wealth or heritage has the same opportunity to vote and create real honest change."

WhiteWinterWolf

@M'vy The probability of theft remains low, but depending on the passwords stored in it the risk becomes huge (and would I use such a book it would not be to store only half of my passwords).

Actually, the risk is so huge that your bank will most likely not reimburse you when your account gets flushed because you wrote your password in such a notebook, as this goes against their recommendations.

M'vy

Yeah, maybe.

obviously, if they have to prove it...

WhiteWinterWolf

14:02

I don't think that threat / violence to get URLs and password is a common threat for common citizen, but bag snatching certainly is, and the presence of such notebook in the bag would certainly be some kind of jackpot for the thieve.

M'vy

Yeah, obv if you have your bank account passwd in there...

WhiteWinterWolf

@M'vy Incoming connection directly with the right username and password, try to explain there was no leak...

M'vy

@WhiteWinterWolf i'm pretty sure you can invalidate your account long before they get to access it. Unless you're in a desert

The case is tricky though

well, as it does usually with password management.

WhiteWinterWolf

@M'vy I don't think it is unreasonable to assume so. People have got too much password to remember: banking, insurance, health-related services, administrative services to pay taxes online, etc. This without even talking of social media, forums and so on where the account could also be use for scam attempts (at least).

M'vy

indeed.

Guess the guy who steals your creds, and unless it's easy to access the bank account, will probably resell it first.

they are mostly into the "easy to get money" I assume.

Password are such a hassle...

they need to be complicated and random enough, but that cause them to be not human useable, then you need a password manager, that you have to synchronise and have access anywhere, so you need crypto, so you need to be able to uncipher on the target machine...

Maybe there is an inbetween

WhiteWinterWolf

14:11

@M'vy That's the goal of encrypted password storage: maybe thieves manage to decrypt it, but by the time you will be able to change all passwords so there will be no issue. Here, with clear texts, its a question of minutes, you have dozens of passwords to change, and you don't have the list of actual passwords to revoke:

no list of URL so you will certainly miss some, no list of passwords to actually access the account to change them so you have to call the support of each company and prove your identity.

M'vy

maybe if you divide the passwords in two parts with two notebooks ? :)

not stored in the same place obv

seeded passwords notebooks (so you can have your own copy on your computer)

WhiteWinterWolf

@M'vy For user-chosen free passwords, a simple trick to slow down thieves might be to use a common prefx or suffix for each password not written in the notebook. Initiatives like the Password card also seem tempting (it goes along with your seeded idea I think), albeit more complex to use, otherwise for people who do not want to handle the protection of their password manager there are online services (whether browser's sync feature or services like LastPass).

M'vy

Yeah, seems interesting

Rоry McCune

15:16

@WhiteWinterWolf well banks will try to avoid liability where-ever possible. One wonders if they would refuse compensation where the user has chosen the same password for multiple sites

although really the answer for high value applications is 2FA

the bank shouldn't be allowing transactions where static data has been used for auth. alone

M'vy

@RоryMcCune well, they do

Rоry McCune

personally I wouldn't use a bank that did this any more :)

even SMS based 2FA is better than no 2FA

M'vy

Well, they do 2FA for online payments ...

but not to connect to the webste

Rоry McCune

yeah so anything transactional (i.e. I can actually steal money) should need 2FA

M'vy

it should

Actually I activated a service, I should check if I got ask for confirmation on mobile when transfering from the website

Anyway, no luck finding a website to print a notebook

and book printing is all about quantity of the same book, so no good

I bet I could have a Proof of Concept using a photoalbum editor

eheh you can get a A6 photo album of 16 pages for less than 7 euros

oh even better. There's one who does 7.95 for 26 pages (I wonder if this covers the covers)

Seems to be 26 photos + covers. Good.

So for 37.79, you can print a 2x 2 codebooks, with personalised cover. Then you buy a cheap directory book to register your passwords as Red book (Letter - Number) - Blue book [Letter - Number] and there you go :)

The index might even be digital, or in your memory

If there is enough passwords per page, you can even consider it a public resource (therefore you only need one I guess)

And indexes could also be embedded into seal containers for 'critical case' use by the Wife :)

« first day (2118 days earlier) ← previous day next day → last day (3060 days later) »

all rooms