Assume your devices are compromised

Re:Assume your devices are compromised by phphphphp on Sunday April 17, 2022 @05:55PM (#31064848)

I debate this with myself often. Short of renting a security box and telling people I trust about it, I haven’t come up with a strategy for the master password. At the moment, I’ve resigned myself to the feeling that if I lose my memory, maybe it’ll be the opportunity for a fresh start, and so losing everything is a feature not a bug.

[ Parent | on HN ]

Re:Assume your devices are compromised by g3rv4 on Sunday April 17, 2022 @07:15PM (#31065440)

Shamir Secret Sharing could be the answer you're looking for... I'm sleeping better at night

here's a quick blog post I wrote with my plan. The app is trivial to write if you find a library for your preferred language

https://g3rv4.com/2022/04/a-plan-for-my-secrets

[ Parent | on HN ]

Re:Assume your devices are compromised by orangepurple on Monday April 18, 2022 @09:23AM (#31070206)

If you lose your memory you better have instructions written clearly on paper not some app which you won't remember how to build or install

[ Parent | on HN ]

Re:Assume your devices are compromised by g3rv4 on Monday April 18, 2022 @10:19AM (#31070977)

instructions are on my blog :)

[ Parent | on HN ]

Re:Assume your devices are compromised by orangepurple on Monday April 18, 2022 @04:33PM (#31076114)

And if you can't update your blog or can't pay for it because you lost your memory? The low tech solutions can't be beat, especially if you expect others to help you pick up the pieces with minimial technical sophistication.

[ Parent | on HN ]

Re:Assume your devices are compromised by g3rv4 on Monday April 18, 2022 @07:01PM (#31077768)

I agree, if I lost my memory and can't remember how to access my blog or run docker then I'd be out of my digital life.

In that scenario though, I'd also be out of my digital life even if I had access to 1password.

[ Parent | on HN ]

Re:Assume your devices are compromised by cyphar on Monday April 18, 2022 @05:59AM (#31068961)

I wrote a tool for this[1,2], though it's still a work in progress (all the features work but I still need to finalise the QR data format and work on user-friendly interfaces).

[1]: https://github.com/cyphar/paperback [2]: https://youtu.be/GI9rKdM9rB8

[ Parent | on HN ]

Re:Assume your devices are compromised by g3rv4 on Monday April 18, 2022 @12:03PM (#31072538)

I wish I found your app before I wrote mine [1] :) you seem to be way better versed in cryptography than I am. What's the advantage of having the main document and the keys separated?

[1]: https://g3rv4.com/2022/04/using-shamir-secret-sharing

[ Parent | on HN ]

Re:Assume your devices are compromised by cyphar on Wednesday April 20, 2022 @10:50AM (#31097769)

I wouldn't say I'm very well-versed in cryptography. The reason they're separated is that it allows you to:

  * Further split up the trust such that the key shards can be held by one group but they don't have access to the document (maybe you keep a copy of the document with a lawyer but distribute the keys among your friends and family so that if your lawyer is hacked or bribed they can't reveal the secrets, same goes for if your friends conspire against you).
  * Make the shards small, independent of the document size, so that they're always practical for friends to store even if you have a very large document to save.
  * You can do a quorum expansion (create new shards that are compatible with the existing shards) without revealing the secret.

To be fair, for practical uses this is not super necessary but it adds flexibility without losing anything in return (I would argue the quorum expansion point is actually a useful feature).

[ Parent | on HN ]

Re:Assume your devices are compromised by wanderingmind on Sunday April 17, 2022 @07:51PM (#31065703)

Bitwarden (premium) has a really nice service of granting access to emergency contact based on prespecified wait time [1]. This can be used in any emergency situation.

[1] https://bitwarden.com/help/emergency-access/

[ Parent | on HN ]

Re:Assume your devices are compromised by jvanderbot on Sunday April 17, 2022 @06:19PM (#31065042)

Just send four trusted family members half of the passphrase in a sealed envelope and tell them what it's for. If your family has a lawyer or safe deposit box trusting that instead is a 1000x better option.

[ Parent | on HN ]

Re:Assume your devices are compromised by Spooky23 on Sunday April 17, 2022 @09:06PM (#31066208)

Lawyer yes, safe deposit hell no.

Three reasons:

- Banks fubar safe deposit boxes all of the time, in a variety of ways.

- Once the bank figures out that you’re dead, it’s sealed without a court order.

- As you get older it’s more likely that you’ll screw up payments, lose keys or codes, etc.

Also, the attorney will advise your loved ones on what they can do. For example, you need a power of attorney for many things.

[ Parent | on HN ]

Re:Assume your devices are compromised by TedDoesntTalk on Sunday April 17, 2022 @11:05PM (#31066890)

Never, ever use a safe deposit box at banks:

https://www.nytimes.com/2019/07/19/business/safe-deposit-box...

[ Parent | on HN ]

Re:Assume your devices are compromised by wintermutestwin on Monday April 18, 2022 @10:06AM (#31070771)

>Never, ever

Despite the issues, there are still valid uses for a safe deposit box. I live in a highly fire-prone area and keep a backup drive with family photos and documents in a safe deposit box in a local place that won't burn when I do.

[ Parent | on HN ]

Re:Assume your devices are compromised by TedDoesntTalk on Monday April 18, 2022 @10:20AM (#31070987)

So long as you don’t expect the drive to be there when you retrieve it, sure. You should probably also encrypt any sensitive document on it. Here’s one example. Just one:

https://abc7news.com/archive/8973198/

Note the police are not classifying this as a criminal case (theft), but a civil case.

[ Parent | on HN ]

Re:Assume your devices are compromised by npteljes on Monday April 18, 2022 @06:59AM (#31069252)

Can lawyers be trusted with this? Do they also properly manage their own death and other events? I don't have any experience and I'm genuinely curious how all this works.

[ Parent | on HN ]

Re:Assume your devices are compromised by simonebrunozzi on Saturday April 23, 2022 @12:28PM (#31135710)

> - Banks fubar safe deposit boxes all of the time, in a variety of ways.

Which is why you need to put a tamper-proof box INSIDE a security box in a bank. Key to that box will be in your house, far away from bank personnel.

[ Parent | on HN ]

Re:Assume your devices are compromised by jvanderbot on Sunday April 17, 2022 @09:44PM (#31066421)

excellent point!

[ Parent | on HN ]

Re:Assume your devices are compromised by chrisweekly on Sunday April 17, 2022 @06:13PM (#31064993)

I wrote mine down and put it in an envelope containing a few other secrets in a small fire-resistant, waterproof safe which my wife knows how to open.

[ Parent | on HN ]

Re:Assume your devices are compromised by CamelRocketFish on Sunday April 17, 2022 @06:30PM (#31065115)

Which safe did you get?

[ Parent | on HN ]

Re:Assume your devices are compromised by hanniabu on Sunday April 17, 2022 @08:16PM (#31065880)

Fire safes are so shitty you'd probably be better off buying a small one to keep your documents/backups in and then a larger one to put that safe in for double insulation.

[ Parent | on HN ]

Re:Assume your devices are compromised by chrisweekly on Sunday April 17, 2022 @09:59PM (#31066499)

Itis a small portable one; more akinto an outrageously bulky, heavy, awkward briefcase than a bank vault.

[ Parent | on HN ]

Re:Assume your devices are compromised by EVa5I7bHFq9mnYK on Monday April 18, 2022 @06:11AM (#31069018)

So basically you bet everything on eternal love.

[ Parent | on HN ]

Re:Assume your devices are compromised by usrn on Sunday April 17, 2022 @06:44PM (#31065251)

I publish or write down most of the things I want to keep in that scenario.

[ Parent | on HN ]