Comment on Current account recovery best practices?
Darkassassin07@lemmy.ca 11 months ago
I have a backdoor into my home vpn using a series of usernames, passwords, and long obfuscated http paths.
In an absolute emergency, I can traverse that maze, retrieve a key+config to connect to openVPN, then reach my vaultwarden vault. No 2fa on that vault as it’s not accessible from WAN. (though technically I could add 2fa and still be able to disable just the 2fa from vaultwardens admin console)
viking@infosec.pub 11 months ago
Do you have all the paths, usernames and passwords committed to memory? My biggest fear is making it so secure that I don’t remember it myself, since I’ll effectively never use it until the emergency case occurs.
Darkassassin07@lemmy.ca 11 months ago
Yeah. They’re all human readable but non-obvious instead of random strings. Stuff that’s easy to remember but difficult to guess. You’ve just got to avoid typical patterns like ‘randomwords526!!’ or ‘p00rex@mpl3’.
I do like to exercise that memory now and again, testing that I remember and that everything’s functioning as it should. Just in case, theres instructions on paper in a safe place.
Being four separate item’s minimum: subdomain, path, username, and password, none of which are published anywhere ofc; makes it pretty secure. The openVPN config/key needs a password as well, so 5 items.
viking@infosec.pub 11 months ago
Right, I’ve taken a similar approach now. Unknown subdomain at an unknown domain which is not accessible from the web, only via ftp. FTP username and password are known only to me, long and obscure but not forgettable. Then a random subfolder-tree down in an outdated cgi-bin script. In the folder I’ve got a password protected zip archive with dropbox recovery codes, and in the dropbox finally my google codes in yet another password protected archive. All passwords different and never been in any reported breach.
That’s gotta do it for now. Thanks a lot for your input!