News for hackers. Stuff that matters.
Re:Top Bitcoin dev gets owned by throwaway9870 on Sunday January 01, 2023 @04:07PM (#34210887)
I am not a security person, but I can't help but wonder where the advice of not writing things down comes from? I think my wife's password book on her desk is a lot more safe than most computer experts.
Re:Top Bitcoin dev gets owned by kube-system on Sunday January 01, 2023 @04:22PM (#34211065)
That advice mostly originates from security folks working in workplace environments, where passwords that are written down may be visible to people who are threat vectors.
Re:Top Bitcoin dev gets owned by andrewstuart on Sunday January 01, 2023 @04:11PM (#34210944)
Say your wife is a well known Bitcoin billionaire.

And your wife bought something from my eBay store. Now I have your home address.

And if I am a ruthless character then I quietly break into your house one day with th3e objective of leaving no sign I was ever there. Search for written down passwords, take a photo, leave.

Re:Top Bitcoin dev gets owned by mjr00 on Sunday January 01, 2023 @04:20PM (#34211045)
Okay, so assuming you get past this theoretical billionaire's physical security (at a minimum gated fences and an alarm system; if they're actually a billionaire, probably 24/7 armed private security as well) and into their mansion, how long do you think it would take you to search their 7 bedroom 10000 square foot mansion for these written down passwords which you have no information as to whether they even exist?
Re:Top Bitcoin dev gets owned by andrewstuart on Sunday January 01, 2023 @04:24PM (#34211086)
You get Tom Cruise to do the job of course.
Re:Top Bitcoin dev gets owned by mk89 on Sunday January 01, 2023 @07:30PM (#34212783)
Ahahaha
Re:Top Bitcoin dev gets owned by onlyrealcuzzo on Sunday January 01, 2023 @04:48PM (#34211342)
If you're going to rob a billionaire, you're probably not doing it cartoon style.

You'd find a legit way into the house.

Re:Top Bitcoin dev gets owned by HL33tibCe7 on Sunday January 01, 2023 @05:04PM (#34211505)
You get hired as a cleaner
Re:Top Bitcoin dev gets owned by nemo44x on Sunday January 01, 2023 @04:15PM (#34210989)
Why make it so complex? Just do a title search online and you’ll get access to their address if they own a home.
Re:Top Bitcoin dev gets owned by rblatz on Sunday January 01, 2023 @04:40PM (#34211259)
Unless they own it in a trust.
Re:Top Bitcoin dev gets owned by andrewstuart on Sunday January 01, 2023 @04:17PM (#34211007)
Of course its obvious there's many ways to get someone's address.

The point is that companies put vast effort into digital security but in many cases it's easily compromised by going to the home of the person that is the hacking target.

Re:Top Bitcoin dev gets owned by recuter on Sunday January 01, 2023 @04:23PM (#34211082)
If they schlep to your house and successfully break in they might as well tie you up and beat the password and whatever info they need out of you.

Especially if your parents accidentally left you home alone..

Re:Top Bitcoin dev gets owned by zikduruqe on Sunday January 01, 2023 @05:00PM (#34211470)
So the "Live, Laugh, Love" sticker on the kitchen wall isn't safe? /s
Re:Top Bitcoin dev gets owned by danfoxley on Monday January 02, 2023 @01:13AM (#34214915)
Hilarious
Re:Top Bitcoin dev gets owned by jeroenhd on Sunday January 01, 2023 @04:16PM (#34211002)
Password books are basically physical password managers. The only problem I have with them is that the passwords in most password books I've seen aren't very creative or random. As long as you write down randomly generated passwords instead of permutations of the names of your kids/pets/parents, I don't know what people are panicking about.

The perfect password book is combined with a word you remember but don't write down as a pepper, but I doubt it's much of a problem in practice; it takes one leak of an u hashed password to break the code.

I think for many the risk of someone breaking in and stealing your password book is much smaller than the risk of a centralised password manager getting hacked (LastPass and friends).

Re:Top Bitcoin dev gets owned by foobarian on Sunday January 01, 2023 @08:32PM (#34213179)
My fear with a password book (wife has one, different than OP) is it getting lost or destroyed.
Re:Top Bitcoin dev gets owned by Jach on Sunday January 01, 2023 @09:05PM (#34213380)
I worry about this more with things like hardware keys / flash storage
Re:Top Bitcoin dev gets owned by dan-robertson on Sunday January 01, 2023 @04:29PM (#34211147)
I think it’s reasonable advice for most people. The alternative is usually having a simpler password which is worse if your threat model is ‘hashed password shows up in big breach’. If your threat model is ‘someone turns up to your house to get your password’ your worry should not be theft of the paper.
Re:Top Bitcoin dev gets owned by cma on Sunday January 01, 2023 @04:09PM (#34210918)
Someone kept theirs in their wallet, and their passphrase showed up on a publicly released police body cam the other day when their insurance was checked or something.
Re:Top Bitcoin dev gets owned by rileymat2 on Sunday January 01, 2023 @04:13PM (#34210965)
It comes from the threat model, having a password book on your desk in a cubicle is absolutely not secure.

On a desk at home? It is marginal, certainly a burglary is a low frequency event, but we also have events like fire that make it insecure in other ways.

Re:Top Bitcoin dev gets owned by im3w1l on Monday January 02, 2023 @12:20AM (#34214636)
The biggest threat with this scheme is you. After that your kids, your house keeper, your friends and visitors.