6 ms·

I have a paper notepad where I keep my secrets. No fucker can hack me.

by bobse 3y ago

dartos 3y ago
Just never take it outside or the camera satellites will snap a pic
- CoastalCoder 3y ago
  Oh, please. Everyone know the satellites are arranged into a constellation to form a massive C.T. scanner. So leaving the house is irrelevant.
  - jjoonathan 3y ago
    So you're saying my passwords need a tinfoil hat too? :o
kioleanu 3y ago
My wife used to have one of those. The amount of times she called me to read a password from the notebook because she forgot it at home is… well… quite staggering
- lxgr 3y ago
  Thinking about this scenario, but combined with AI voice impersonation, makes me very uncomfortable.
  - mdaniel 3y ago
    relevant: https://news.ycombinator.com/item?id=37500895 https://news.ycombinator.com/item?id=37500895 The "hang up and call back" defense also would work with your "wife clone attack" too
    - lxgr 3y ago
      "Hey, I dropped my phone and wallet into the river when getting off the ferry, somebody was kind enough to borrow me a few quarters to make this call, please, I really need my Google password so I can log in at work and contact the bank and order new cards and a phone" – what would you do? Sure, very often the story won't check out, people will be able to detect the fake AI voice etc., but that's always been ok for the scammers – as long as it works sometimes.
      - seanthemon 3y ago
        "we don't have any ferries here, be-gone imposter!"
ndsipa_pomu 3y ago
However, that leads to the problem of either always carrying it with you, which makes it more likely to be lost or stolen, or not having it with you when you want access to it. The lack of backups is also a concern.
- darkwater 3y ago
  > The lack of backups is also a concern. Carbon copy
  - somehnguy 3y ago
    Not sure that's a great solution - it implies you either have to 1. Carry around your carbon copy with you - making it not really any backup at all 2. Remember to make your carbon copy at a later time every time you create or update a password - pretty cumbersome and prone to forgetting Plus if you have any decent number of passwords you're dealing with many pages (*2 for the carbon copy), which is also error prone. What about longer passphrases as well? I have a bunch of very long phrases I use as encryption keys and such that would be very annoying to manually write out.
- moffkalast 3y ago
  Same applies for using mobile phones as 2FA.
  - latchkey 3y ago
    Depends on the 2FA app and where it backs its codes up.
fastball 3y ago
Obligatory XKCD: https://xkcd.com/538/ https://xkcd.com/538/
- xoa 3y ago
  Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. That it gets pushed an astonishingly high number of times on technical forums kind of illustrates though how little critical thinking even people who should know better do sometimes I guess. And I suppose how fractally wrong it is can be a good starter for discussion. Edit: commenting about downvotes is almost always pointless. But pointing out the truth about this comic always gets lots of commentless downvotes, and so this time I want to say that you people are wrong, and you are actively misinforming people. Security is about economics, increasing the time/cost for attackers vs defenders. Additionally, different security measures are about specific threat models. Encryption is entirely orthogonal to physical attacks, which are addressed by physical defenses. But physical attacks are much more expensive and riskier, if they're possible at all, vs electronic. And encryption still yields the important value of knowing you were attacked at all. If you are going through an airport and they demand your password at gunpoint, you can surrender it right away and you've lost nothing, but now you also know they were interested and all the data is likely compromised. Whereas if it was all unencrypted, they could have just quickly and transparently copied it all off, added a root kit, etc with you never being the wiser. But in much of the world, official services threatening you physically isn't legal. And if it's criminals, how often is the "lead pipe" a thing vs "we stole this from some tourist and we don't even know who it belongs to" or the like? XKCD is rightfully popular. But this comic is shallow and bad. It shouldn't be held up as at all valuable in security discussions on HN or anywhere else.
  - lukevp 3y ago
    Perhaps you could take this opportunity where you’ve gotten the attention of an audience to, instead of criticize, educate us? I don’t see what’s wrong with this comic at all. It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Perhaps you think the link was to a different comic (maybe the entropy one about the horses and the batteries) and didn’t actually click it?
nilamo 3y ago
So you lose everything everywhere in the event of a fire, flood, etc? That doesn't sound like an improvement...
paulryanrogers 3y ago
Assuming all passwords are long, random, and unique. Preferably paired with MFA where possible.

I have a paper notepad where I keep my secrets. No fucker can hack me.

by bobse 3y ago

I have a paper notepad where I keep my secrets. No fucker can hack me.

dartos 3y ago

Just never take it outside or the camera satellites will snap a pic

CoastalCoder 3y ago
Oh, please. Everyone know the satellites are arranged into a constellation to form a massive C.T. scanner. So leaving the house is irrelevant.
- jjoonathan 3y ago
  So you're saying my passwords need a tinfoil hat too? :o

kioleanu 3y ago

My wife used to have one of those. The amount of times she called me to read a password from the notebook because she forgot it at home is… well… quite staggering

lxgr 3y ago
Thinking about this scenario, but combined with AI voice impersonation, makes me very uncomfortable.
- mdaniel 3y ago
  relevant: https://news.ycombinator.com/item?id=37500895 https://news.ycombinator.com/item?id=37500895 The "hang up and call back" defense also would work with your "wife clone attack" too
  - lxgr 3y ago
    "Hey, I dropped my phone and wallet into the river when getting off the ferry, somebody was kind enough to borrow me a few quarters to make this call, please, I really need my Google password so I can log in at work and contact the bank and order new cards and a phone" – what would you do? Sure, very often the story won't check out, people will be able to detect the fake AI voice etc., but that's always been ok for the scammers – as long as it works sometimes.
    - seanthemon 3y ago
      "we don't have any ferries here, be-gone imposter!"

ndsipa_pomu 3y ago

However, that leads to the problem of either always carrying it with you, which makes it more likely to be lost or stolen, or not having it with you when you want access to it. The lack of backups is also a concern.

darkwater 3y ago
> The lack of backups is also a concern. Carbon copy
- somehnguy 3y ago
  Not sure that's a great solution - it implies you either have to 1. Carry around your carbon copy with you - making it not really any backup at all 2. Remember to make your carbon copy at a later time every time you create or update a password - pretty cumbersome and prone to forgetting Plus if you have any decent number of passwords you're dealing with many pages (*2 for the carbon copy), which is also error prone. What about longer passphrases as well? I have a bunch of very long phrases I use as encryption keys and such that would be very annoying to manually write out.
moffkalast 3y ago
Same applies for using mobile phones as 2FA.
- latchkey 3y ago
  Depends on the 2FA app and where it backs its codes up.

fastball 3y ago

Obligatory XKCD: https://xkcd.com/538/ https://xkcd.com/538/

xoa 3y ago
Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. That it gets pushed an astonishingly high number of times on technical forums kind of illustrates though how little critical thinking even people who should know better do sometimes I guess. And I suppose how fractally wrong it is can be a good starter for discussion. Edit: commenting about downvotes is almost always pointless. But pointing out the truth about this comic always gets lots of commentless downvotes, and so this time I want to say that you people are wrong, and you are actively misinforming people. Security is about economics, increasing the time/cost for attackers vs defenders. Additionally, different security measures are about specific threat models. Encryption is entirely orthogonal to physical attacks, which are addressed by physical defenses. But physical attacks are much more expensive and riskier, if they're possible at all, vs electronic. And encryption still yields the important value of knowing you were attacked at all. If you are going through an airport and they demand your password at gunpoint, you can surrender it right away and you've lost nothing, but now you also know they were interested and all the data is likely compromised. Whereas if it was all unencrypted, they could have just quickly and transparently copied it all off, added a root kit, etc with you never being the wiser. But in much of the world, official services threatening you physically isn't legal. And if it's criminals, how often is the "lead pipe" a thing vs "we stole this from some tourist and we don't even know who it belongs to" or the like? XKCD is rightfully popular. But this comic is shallow and bad. It shouldn't be held up as at all valuable in security discussions on HN or anywhere else.
- lukevp 3y ago
  Perhaps you could take this opportunity where you’ve gotten the attention of an audience to, instead of criticize, educate us? I don’t see what’s wrong with this comic at all. It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Perhaps you think the link was to a different comic (maybe the entropy one about the horses and the batteries) and didn’t actually click it?

nilamo 3y ago

So you lose everything everywhere in the event of a fire, flood, etc? That doesn't sound like an improvement...

paulryanrogers 3y ago

Assuming all passwords are long, random, and unique. Preferably paired with MFA where possible.