Death by Password...

[jefboyardee]

I'm increasingly fed up with the apparent future of life on the net. Articles like...

Now that password managers are vulnerable, is anything secure?

...make me wonder if all this wonderful technology, no matter how hard it's protected, will ultimately blow up in all our faces, one by one. What then? Just cash and checkbooks?

 

[dontpanicbobby]

An actual physical key could be the answer. Now I'm not talking about something the size of a house key, I envision something around the size of a microSD key chain card reader. This of course would mean the return of card slots on all phones and I'm sure manufacturers will figure what the heck lets make room for an actual MicroSD card while where at it.

 

[mikedt]

Well banknotes and cheques can be faked as well of course.

Anything that relies on just passwords, even with password managers, sure they can be hacked. I still think multi-factor authentication might be the best and most secure, e.g. Google Authenticator. A hacker might have your password, but unless they got physical unlocked access to your phone as well, they're not going to get in.

Multi-factor authentication being...
Something you know...like a password.
Something you have...like your phone or security-token, key-chain dongle, etc.
Something you are...which would be biometrics, fingerprints, etc.
...and you use two of them.

My bank uses multi-factor login. I have to know the password obviously, but they also verify me by sending an SMS to my phone with a number code which has to be entered. Google can do SMS verification as well.

Security-tokens being things like this, and used in addition to just passwords alone.

 

[codesplice]

I'm with @mikedt: a multifactor approach is the way to go.

No one avenue is 100% secure - you could steal my token, hack my password, or cut off my finger (or, more realistically, lift my print from something I've touched) - but combining them together (and thus requiring an attacker to do all of those things) increases the overall security significantly.

Then you just have to worry about the actual authentication mechanism being vulnerable.

 

[jefboyardee]

I like the Authenticator concept. I also wonder if I should have gone with encryption already. And that makes me wonder how one would do either on a Windows PC as well.

 

[jefboyardee]

I also wonder if I should have gone with encryption already ... on a Windows PC as well.

You can encrypt your hard drive, but the protection may not be worth the hassle

 

[codesplice]

I don't generally see the need for whole-disk encryption on a PC except under very certain circumstances - and all three of my work-provided computers have Bitlocker enabled on all drives. Are you seriously concerned about Them discovering the contents of your system32 folder? It makes a lot more sense (to me, at least) to use something like VeraCrypt to create an encrypted volume inside your existing file system. You can keep all of your sensitive stuff safe and secure without the hassle and headaches and performance hits that can be side effects of full disk encryption.

 

[jefboyardee]

The data I have is not all that valuable, but I might try VeraCrypt anyway. I guess when I started this thread, I was just kvetching about the future of online security, that all safeguards will eventually be compromised... the end is near and all that.

 

[codesplice]

The good news is that security is actually improving across the board rather than the other way around. We're not going to go back to using checks.

 

[jefboyardee]

I suppose I'd be better off if I didn't read stuff like this:

It may be time to money under the mattress. High profile fund managers explain how to prepare for a 'systemic event'

 

[ekyle]

Yep, multi-factor is the way to go. Even if someone gets your password they can't get in without the other information or keys.

 

[andruoid]

All my passwords are in my head. I use to use a PW manager but found it unreliable.

 

[mikedt]

I store all my passwords on Internet forums.


qwerty
password
123456
gandalf
abcdefg
asdfghjkl
michael

 

[psionandy]

I use my children's names as passwords... My son is called 1hfdsyrfh and then my twin daughters are called udseuutt3wiuyy and password123

 

[andruoid]

udseuutt3wiuyy was the most popular girls name last year. I'd change your password.

 

[jefboyardee]

Here’s How an Attacker Can Bypass Your Two-Factor Authentication

 

[codesplice]

Here’s How an Attacker Can Bypass Your Two-Factor Authentication

Good article, and it's important to remember that no one mechanism can be entirely invulnerable from every direction. By layering multiple security practices you can significantly increase the work required to gain access to your account.

Whatever the problems, an account with two-step verification set up will always be more secure than the same account without two-step verification.