Patch Lady – 31 days of paranoia – day 2

Topic

New Reply

Patch lady here – with day 2 of 31 days of paranoia. Today I’d like to remind you of how much we’ve become depended on passwords and yet how fragile t
[See the full post at: Patch Lady – 31 days of paranoia – day 2]

Susan Bradley Patch Lady/Prudent patcher

3 users thanked author for this post.

Elly, woody, NetDef

Reply | Quote

Replies

All of my clients store (in a physical safe) the magic “what if R gets hit by a bus” book.

Yes, on paper.  Bound in a thin black binder.

These contain all admin account usernames, the target for which the account exists, why it exists, how that target integrates into the stack, and of course the current password and challenge questions if any.

One problem we have run into:  with the requirement that certain assets be protected with MFA, what’s the best path to allow replacement staff (in the event of my untimely death) into their assets if my phone or MFA linked app is crushed along with me by that hypothetical (I hope) bus??

 

hmm . . . .

~ Group "Weekend" ~

Reply | Quote

When the MFA allows email, I’ve set up a group email box so that both people get the MFA token. Haven’t worked out the cell phone problem yet.  Good questions.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

NetDef

Reply | Quote

To partially answer my question above:

For some services (O365) with Admin MFA enforced, we have options to allow any one of multiple auth processes.  This could include an SMS to my phone, MS Auth app, or even a phone call to an office number.

For other services (some domain registrars, web hosts, etc) they will allow you to generate a (loooong) emergency recovery key string that you can print or store in a secure location.

Still there are a few that don’t seem to allow for the loss of the authenticated device or account or phone number.

~ Group "Weekend" ~

Reply | Quote

Passwords are literally the key to lots of aspects of our business and private lives, and it is essential that we find a way of enabling others to access them in the event of our substantial absence but without compromising the security that they are intended to provide in normal circumstances.

The company I worked for during the final umpteen years before I retired established a record of each main director’s written summary of what exactly he or she did, on the basis that their colleagues would then know what exactly they had to take over in the event of the proverbial “hit by a bus” scenario. That isn’t actually too far-fetched, I worked for a previous company where one of the senior partners left the office at the end of the working day and died from a heart attack on the way home. These things have to be anticipated if they aren’t to cause massive disruption on the thankfully rare occasions that they occur.

When the first company I mentioned introduced their record of director’s responsibilities etc, it was explained to me by the Managing Director who was a bit surprised when I replied “Yes, but how would the company operate without computers if the electricity went down for an extended period of say a few months following say a terrorist outrage at a power station?”

He thought that too far-fetched a scenario to be considered seriously (although it’s known that the IRA had planned just such an attack in England some years earlier), and said he thought that the company was well in control of its computer systems. That led me to ask why then it had recently been necessary during a company-wide computer problem to recall the Head of IT from holiday on the other side of the world as he was apparently the only person who could fix the problem? “Fair point!” the MD replied.

Susan, this promises to be a very worthwhile series on paranoia, and if you’re short of a topic may I suggest tackling the degree to which we are all, especially businesses, over-reliant on computers!

Reply | Quote

Good point.  I will plan on a “time out” topic on how much we are relying on technology to our detriment.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

Elly

Reply | Quote

I use KeePass 2.x for all passwords. Sites/services that allow 2FA are set up via Authy and my iPhone 7+. My wife and kids could figure out my KP Master Password fairly easily to get in to everything. My KP .kdbx database is backed up to Google Drive for access anywhere.

I have no idea what 99% of my passwords are; they are random strings of gibberish anywhere from 12-40+ characters (where allowed). It’s funny, anytime my wife asks for a password to log in somewhere (recently, this was Amazon Music on her phone), she gave me a dumbfounded look when I tried to tell her the password. One of these days I’ll get everyone else in the house using KeePass as well.

Reply | Quote

What is not stored on my HD, cannot be stolen from it, or get lost by hardware damage.

My advise is simple. Do as little online and computer transaction as possible. A life this way is possible, you know. Do not use password managers. Do not store passwords on your HD. Do not allow browsers to store passwords. Manually log in every time you visit that site, forum, shop. Keep the number of such services, shops etc small, as small as possible. Do not use the same password for several sites (you would be surpised how many people do that).

Or in simple words: go into that book shop instead of ordering from Amazon. You can search and investigate online wonderfully. (Do so without logging in anywhere and thus allowing them to profile your search preferences). Who says you must necessarily buy online? (Especially in Germany where books have fixed prices and cost the same everywhere, in all shops offline and online).

The biggest security risk is the belief that all and everything must be done via apps, online, computers. I wonder how some people managed to survive until today while just 15 years ago all this was relatively new and still “exotic”.

I log in somewhere only when I really want (=”need”) to buy there, or want to post on that forum. Mostly, I stay anonymous everywhere. One of my two main reasons why I stopped fooling around with stocks one and a half year ago, were serious security concerns regarding financial apps that I needed to do so. The days when Android was fail-safe and was not under attack at all, are long since over. I do not trust smartphones. To me, a smartphone just is a target of somebody else. Why people store sensible data on smartphones –  that could be stolen, infested, corrupted, lost – is completely beyond me. I laugh today that I did that for some time myself. Thank goodness I woke up before getting hit hard.

A good compromise also is to have your passwords in a simple .txt-list on a USB stick, of coruse heavily encrypted. When needed, you paste and copy the needed one. I would always keep not needed sticks and HDs physically disconnected from the active platform, of course. Plug in, log in, unplug: and then do your action.

Marc

3 users thanked author for this post.

Spiral, wdburt1

Reply | Quote

An alternative is to use a throwaway password for sites where it doesn’t matter.  (That’s a problem today–sites that officiously demand username and password where the need is not really apparent, except to keep some other purchaser from pretending to be you.)

By “throwaway” I mean a password that can be hacked, and you don’t care.  In my case, I think that’s more than half of the sites where I need to have a password.

Reply | Quote

I am a security nut. Here is my routine (but keep in mind I am retired and don’t have to be in the loop).
I give my email out to very few people. I have a separate gmail account for on-line banking. I do online banking because it is so convenient and I justify it by the fact that I check my account daily so that if there was something untoward I would discover it right away and the bank would have to make good and also because some of the hacking is done in the bank itself which online banking has nothing to do with..
I have only two credit cards that I check on a few times a week online. If a store has been hacked or I see something on the card I call them and get a new card. This is not a problem because I use the cards for very few accounts so if I have a new card number there is not much hassle.
I have a separate gmail account for ordering from my very few stores. All my gmail accounts have two factor authentification with a Yubico key.

I use the Firefox browser and DuckDuckGo with https everywhere,adblocker ultimate, ublock origin, privacy badger (all of which I download from the sites themselves as much as possible).

I don’t trust password managers as they can be hacked. For the few accounts that I use they each have a separate password that is written in a book on my desk and also in a binder in my bookcase. They are very long and complicated and nobody but hubby uses my IMac. I even have a bandage over the camera on the IMac. I do not use Siri or any of the programs on the IMac. Long ago I did not trust Facebook or any other social media — my friends and family laughed at me but whose got the last laugh now? Woody’s is the only blog I belong to.

I don’t use anything “in the cloud”. I have nothing of value stored on my computer so that I do not have to back up my computer as anything of value is a hard copy in my desk.

I refuse to have a smartphone and have an embarrassing flip phone that is only really needed to call hubby from the supermarket to ask if we need eggs. I refuse to text as I can be emailed or called on the home phone or the cell phone.

I have locked my credit with the major credit bureaus and minor ones most folks aren’t aware of and I have Security Alerts placed also which now are for one year.

This all may sound over the top but it works for me. My friends laugh at me but they have been hacked and I never have. Also, I am not particulary social and therefore it is easier for me to keep this low profile. I do not keep emails on my computer — if they are of value I copy them to a folder in my desk otherwisw they are deleted. Every evening I delete my google chrome history and cookies and Firefox is set to automatically delete them.
Whew! I think that’s all folks!!

2 users thanked author for this post.

David F, Spiral

Reply | Quote

Did I find a soulmate here?

Much the same like you do I do over here. A smartphone I only have since two years, and mostly for the camera and OSMAND navigation: WLAN is switched on as needed only, and is mostly off , and mobile data is almost never on, only when I travel by train and want train and timetable updates. I have a nice prepaid card for it that limits the monthly costs to fabulous 2 Euros only, for I have no use of SMS and telephone (if I use this, it would cost me 9 cents per message/minute). I reserved only a 100 MB contingent per month, thats what costs me those 2 Euros. 95% of that contingent passes unused, often its the full 100% I do not use.

I pay cash, have no credit card, and have two bank accounts. The one I use for shopping online and the monthly bills like electricity, insurrance etc. It has no overdraft credit and always only holds the money needed for a 1-month interval at max. It gets filled up by a second bank account that holds a higher reserve but has no online access. This way, if my PIN or ID would get stolen, the damage that could be done, already is contained. Most of my treasure is not placed digitally at a bank.

No Twitter, Facebook and the likes for me.

You asked for paranoia – you get it!

Marc

2 users thanked author for this post.

Microfix

Reply | Quote

I pay cash, have no credit card, and have two bank accounts. The one I use for shopping online and the monthly bills like electricity, insurance etc. It has no overdraft credit and always only holds the money needed for a 1-month interval at max. It gets filled up by a second bank account that holds a higher reserve but has no online access. This way, if my PIN or ID would get stolen, the damage that could be done, already is contained. Most of my treasure is not placed digitally at a bank.

In a game of “can you top this paranoia” you are putting me to shame (in a good way!)!  You have given me great banking ideas (the two accounts. etc.)

We use the two major credit cards because we get a cash rebate on all our purchases with them and it is more handy than carrying around cash.  But your system intrigues me.  It also intrigues me when you say “Most of my treasure is not placed digitally at a bank” — do you have any hints for us as to safe places?

It does my heart good to read of your efforts.  As my hubby says: “We are not paranoid — they really are talking about us”!!

EDIT: Formatting/ Quotation

Reply | Quote

Sorry — #221209 was me Peacelady — forgot to sign in.

Reply | Quote

I pay cash, have no credit card, and have two bank accounts. The one I use for shopping online and the monthly bills like electricity, insurrance etc. It has no overdraft credit and always only holds the money needed for a 1-month interval at max. It gets filled up by a second bank account that holds a higher reserve but has no online access.

When you say your bank account “has no online access,” do you mean that the bank itself does not offer online access for your account, or that you haven’t configured it?

The former would be quite secure; the latter is a security hole big enough to drive a truck through.

Reply | Quote

You need fake accounts for everything.

Reply | Quote

The following is not specific legal advice, but I found these references about Digital Assets and Estate Planning online:

Leaving Digital Assets Through Your Will

https://www.nolo.com/technical-support-main/online-will-leaving-digital-assets-through-will.html

Writing a Letter to Survivors

https://www.nolo.com/technical-support-main/online-will-writing-letter-survivors.html

Sample Will and Power of Attorney Language for Digital Assets

http://www.thedigitalbeyond.com/sample-language/

These articles should help get the ball rolling when you discuss the whole process of Estate Planning with your own attorney.

-- rc primak

1 user thanked author for this post.

SueW

Reply | Quote

I’m well aware of bus-related issues for work, but I’ve considered the need for a “bus action plan” on my own personal life.  That’s interesting; while most of my private information I’d not want to give out even to family upon my death, there’s probably a few things that I should set up recovery for.

Reply | Quote