News for hackers. Stuff that matters.
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by nerdjon on Wednesday March 27, 2024 @08:47AM (#39838338)
You can setup a recovery contact incase you do loose the key. I just set that up with my partner and the chance of loosing the key and both of us losing all of our apple devices I think is fairly slim.

I also stuck that key in 1Password (sure it's less safe, but if my 1Password was breached I have far bigger problems than this key being retrieved).

Then keep a hard copy in a safe. Been contemplating sending my parents a safe (who live several states away) with keys on a sheet of paper without context that only I have the combination too. But not sure yet.

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by rjbwork on Wednesday March 27, 2024 @08:50AM (#39838377)
>Then keep a hard copy in a safe. Been contemplating sending my parents a safe (who live several states away) with keys on a sheet of paper without context that only I have the combination too. But not sure yet.

A friend of mine who was (maybe is? he knows I'm not a fan so we don't talk about it much) big into crypto stores his secrets in similar safes with trusted friends and family around the country. I think it's a good idea for things like this tbh.

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by nerdjon on Wednesday March 27, 2024 @08:53AM (#39838401)
I think it is a good idea in theory also, there I just that voice that says "well now that key is out of my possession" and it scares me a bit.

I think I might need to look up to see if there is a known pattern to these keys that it could be easily figured out what it is even if it is just on a sheet with no context. Particularly 1Password which I think is a pattern if I remember correctly.

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by robmccoll on Wednesday March 27, 2024 @09:04AM (#39838523)
You could split the key a few ways if you don't want to trust that one of your stores won't be compromised https://en.m.wikipedia.org/wiki/Shamir%27s_secret_sharing
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by IncreasePosts on Wednesday March 27, 2024 @12:59PM (#39841664)
Or, just apply some simple, easy to remember permutation to the key that no one would be likely to guess - eg rot13 the key, or add 1 to every character, move the first 14 characters of the key to the end of the key, etc.
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by e40 on Wednesday March 27, 2024 @09:55AM (#39839134)
> Particularly 1Password which I think is a pattern if I remember correctly.

What does that mean?

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by hackinthebochs on Wednesday March 27, 2024 @10:07AM (#39839301)
Probably that the key has features that allows 1Password (and potentially anyone) to recognize that its a 1Password key. E.g. Fixed size, patterns of spaces or dashes, specific digits, embedded error correction, etc.
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by nerdjon on Wednesday March 27, 2024 @11:47AM (#39840794)
Yeah that is what I mean.

Similar to how a lot of package companies have a certain pattern, length, whatever for their tracking numbers. If there was a somewhat reliable way to say "This is a 1Password key" or "This is an iCloud key" it makes it means even without context it could be an issue.

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by catlikesshrimp on Wednesday March 27, 2024 @12:32PM (#39841355)
Hard copy? edge the string in a hard surface. My favorite is a rock in my garden. The characters are facing the ground to shield from erosion. The visible surface of the rocks (all of them) is painted white for aesthetic.

Survives a fire, earthquake. No tornadoes or tsunamis here. Nobody has stolen any such rocks from here.

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by lxgr on Wednesday March 27, 2024 @04:58PM (#39844518)
How many people own a safe? I personally don’t know anybody that does. I do know that safes sometimes get stolen.
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by saaaaaam on Thursday March 28, 2024 @03:31AM (#39848591)
You personally don’t know anyone who obviously discloses that they have a safe. If you have a safe you are keeping something valuable secure. The fewer people know that you have something valuable that needs to be secured the better. If people don’t even know your safe exists then that reduces the chances of it being compromised.
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by lxgr on Thursday March 28, 2024 @08:10AM (#39850223)
I know for a fact that many of my friends don’t own a safe, and I don’t think I’m an outlier here.

I don’t doubt that many people do, but it’s still not a solution for the majority of Apple users.