Comment on Current account recovery best practices?
viking@infosec.pub 11 months agoDo you have all the paths, usernames and passwords committed to memory? My biggest fear is making it so secure that I don’t remember it myself, since I’ll effectively never use it until the emergency case occurs.
Darkassassin07@lemmy.ca 11 months ago
Yeah. They’re all human readable but non-obvious instead of random strings. Stuff that’s easy to remember but difficult to guess. You’ve just got to avoid typical patterns like ‘randomwords526!!’ or ‘p00rex@mpl3’.
I do like to exercise that memory now and again, testing that I remember and that everything’s functioning as it should. Just in case, theres instructions on paper in a safe place.
Being four separate item’s minimum: subdomain, path, username, and password, none of which are published anywhere ofc; makes it pretty secure. The openVPN config/key needs a password as well, so 5 items.
viking@infosec.pub 11 months ago
Right, I’ve taken a similar approach now. Unknown subdomain at an unknown domain which is not accessible from the web, only via ftp. FTP username and password are known only to me, long and obscure but not forgettable. Then a random subfolder-tree down in an outdated cgi-bin script. In the folder I’ve got a password protected zip archive with dropbox recovery codes, and in the dropbox finally my google codes in yet another password protected archive. All passwords different and never been in any reported breach.
That’s gotta do it for now. Thanks a lot for your input!