News for hackers. Stuff that matters.
Re:The "email is authentication" pattern by throwaway290 on Sunday September 08, 2024 @03:39AM (#41478826)
More places is more opportunities for the baddies to get it.
Re:The "email is authentication" pattern by kriops on Sunday September 08, 2024 @03:52AM (#41478882)
Shamir it.
Re:The "email is authentication" pattern by sulandor on Sunday September 08, 2024 @05:45AM (#41479327)
please wrap the whole thing as a trustworthy product
Re:The "email is authentication" pattern by cooljoseph on Sunday September 08, 2024 @06:33AM (#41479550)
I don't understand why this was downvoted. In case it's not clear: (S)he's saying to split the key into multiple shares that can be used to reconstruct the key if you have a large enough quorum. Then store each share in a different place. As long as you don't lose too many of the shares, you'll be fine. And one baddie is NOT enough to get the key.
Re:The "email is authentication" pattern by throwaway290 on Sunday September 08, 2024 @08:35AM (#41480033)
Either shuffling those keys stored in N different deposit boxes is overly complicated for a normal person, or it is not overly complicated for a moderately dedicated baddie either
Re:The "email is authentication" pattern by Djdjur7373bb on Sunday September 08, 2024 @12:41PM (#41481379)
Unless the "baddie" in this case is the government, why would it be easy for anyone to obtain access to multiple secrets stored in multiple boxes/banks?

Multisig is a pretty common setup for crypto and there is software that makes it easier.

Re:The "email is authentication" pattern by throwaway290 on Monday September 09, 2024 @10:35AM (#41488938)
Can you show how it can be easy to use in normal life for a regular person and at the same time really difficult for the attacker?:)