Hacker News Reader

Comment by jimmaswell | Hacker News Reader

This would mean I'd have to either remember to carry around a flash drive to access my server from the computers at the college library, or keep a copy of my private key on my networking drive there, a network I don't have any reason to believe is perfectly secure.

View on HN

In either case generate different private keys to use there, so you can revoke the ones used from those computers easily without revoking your more tightly controlled keys.

Private keys are like passwords, try not to re-use them.

This can be quite inconvenient, that's why there's a way to make it more user friendly by using 2FA authentication or Google based SSO with your SSH:

http://gravitational.com/teleport/docs/admin-guide/#openid-o...

I wouldn't use untrusted computers to access my servers.

This. If you're typing in your password on a library computer, you're very vulnerable.

My first server was totally exposed in the DMZ. I ran windows RDP with the password "supersecret" for a long time also. I remember at one point also realizing that I could login to ftp anonymously. It was horrendous security in those early days and I had no idea what the heck I was doing.

Don't scare everybody off because it's not a best practice. If his/her server gets pwned they'll fix, learn, and move on.

A password is fine for your fun server. It's not super secure. It you're probably not interesting enough to get pwned using it.

The problem is insecure PCs and servers are a net negative for the Internet as a whole.

I'm now on a fast enough connection with good enough hardware that if you were able to get into one of my desktops or even just the router I'd be inadvertently sending out a lot of spam or "donating" a lot of bandwidth to a DDoS.

Also, scans of the entire IPv4 internet take less than an hour now, so there's absolutely no security-through-obscurity.

This is wrong. Compromised servers often become part of bot nets that cause real damage.

Heck, even compromised wireless routers[1] and CCTV systems[2] become part of botnets. Anything that's known to be insecure will be exploited.

[1]: http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-h...

[2]: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-...

Any server is interesting enough to get pwned to join in on DDoS botnets. I've seen it happen to so many cheap personal VPSes.

Protect it with a strong passphrase.

https://www.xkcd.com/936/

I recommend reading this XKCD comic for how to come up with strong passphrases.

https://pypi.python.org/pypi/xkcdpass/1.8.2

Nice implementation of xkcd passwords.

Or.. you can use the web with this one!

https://xkpasswd.net/

Bright idea! Using someone elses Computer To generate your password!

It's easier to use for the lay person than a from-source-compilation you execute as a command line binary.

Yes, it's easier, but it's completely and totally insecure.

Security is not terribly hard, but it is completely and totally unforgiving. If you slip up on security, you will suffer, or others will suffer because of you.

Don't slip up on security.

I recently put up on github the latest incarnation of a password generator I've been using for over a decade now.[1]

It uses gpg to encrypt each site's username and a random password (using /dev/urandom or CryptGenRandom as the entropy source) in a separate file ~/Documents/Passwords/<domain>.gpg . At the time I first wrote it, I wanted something that was future-proof and where I could decrypt my passwords anywhere, and where a hardware fault while adding a new password was unlikely to cause corruption of pre-existing passwords.

Make your xkcd wordlist (http://google.com/search?q=oxford+3000 is a good start), one line per word, and bzip2 compress it as ~/Documents/Passwords/wordlist.txt.bz2 (or My Documents\Passwords\wordlist.txt.bz2 on Windows) and run the password generator with --alphabet 100 (restricting choices of "alphabets" to those with over 99 characters) and you'll get xkcd-style pass phrases. I also put some numbers in my word list, so I get passwords like

    blood Evil pint Urge occupy short railway 38
    Diagram elbow Arrest 80 Ceremony monday salt sector

It defaults to making the password/pass phrase length ceil(96 * log(2) / log(len(alphabet))) (96 bits of entropy). If you want to dial that up to 128 bits (or down to 80 bits), put { "bits" : 128 } in ~/Documents/Passwords/config.json (My Documents/Passwords/config.json on windows).

[1]https://github.com/kmag/store_password_gpg

Look at diceware for another great system to generate passwords.

Yes, I started out with a script that used the diceware wordlist to generate passwords and manually used gpg to store my passwords, then evolved my script to combine the two steps I was doing manually.

Have a look at my script. It's all of 200 lines. Easy to audit, and I'm not doing any of my own crypto or random number generation.

And set the encryption to use pkcs8 with a million iterations.

You can also store the key file on your phone and copy it to whatever computer you want to login to, carrying a phone is easier then an extra flash drive

1. Don't use untrusted hosts to access trusted hosts.

2. If you do, put Tails on a USB drive and use S/Key one-time passwords to access your hosts. Tails should protect you from most real-time stealing of your passwords, and S/Key should protect you from most hardware keylooggers (by the time the one-time password is exfiltrated, it's useless).

If you're accessing computers you care about from a computer you don't control, you don't really care about them. It's already game over: sufficiently-advanced software could easily permit you to log in, then execute any sequence of commands leading to the downfall of your servers.

If you want to be paranoid, I wouldn't type sensitive info into those machines (for any number of reasons)

I keep it on my phone.

Reply on news.ycombinator.com