Best Practices for Security Questions?
Best Practices for Security Questions
I'm posting this because a friend lost control of his 1Password and I'm seeing firsthand what a potential disaster he has in front of him.
At the outset, let me make clear that this is NOT a hack of 1Password, but really a problem of the category of password manager. Again - this was NOT a 1P hack.
Essentially, someone installed malware on his PC, captured his 1P password, and download his 1P files (from Dropbox or local copies, not that it really matters). So now someone is sitting on all of his important info, including the obvious stuff, but also pictures of driver's licenses, passports, social security cards, etc. I have all of the same stuff in my 1P, and I'm now extremely nervous about it. I'll probably move all of these documents out to an encrypted archive with a different pw that I don't keep in 1P.
But the biggest problem here is the security questions. We both make the answer to each security question something unique like "sldfjkipsdup9wu98yf7sdgfsdg" and then store that in the notes in 1P. So, now the hacker has the username, password, and answers to security questions. Obviously, he has been changing his passwords and security questions non-stop since he discovered the problem.
I'd like to find some good scheme for keeping these separate, under separate password, but still generally accessible.
I could have a separate vault that I don't link (not exactly sure how to do that, but I assume it's possible).
I could use a different password manager for second level security only.
I could make a locked PDF of my security questions, and keep that in 1P (pain to update though, and I'd have to keep the original somewhere, like in an encrypted DMG on my Mac).
I really think 1P is one of the best apps ever and can't imagine how I conducted business before it (unsecurely, for sure). But the flip side to it is, of course, if you lose it, you lose everything. I really need a way to make some data deeper and less accessible to myself and to hackers.
Anyone have a good strategy?
1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided
Comments
-
Once there is malware, essentially everything is vulnerable. An Attacker could download every file you have, log all keystrokes, etc.
To make it difficult to find a file containing important stuff here are a couple of suggestions.
Store things in a file labelled "cards from my mother" - there's a fair chance an attacker would not steal that.
Depending on your operating system, make the file that stores stuff invisible. Again this might not be found unless there was a keylogger as well.
I suppose your idea is that you would not need to get to the security questions until after you had cleared out the malware, so that an encrypted file would not have had its password stolen.
AgileBits have a program called Knox for creating an encrypted collection of files. I am not sure if it has a trial version that would work for you.
Or an encrypted dmg would work.
I think combining one of my first two suggestions with some form of encryption might be best. At least it reduces the risk that an attacker could just delete your file of answers to security questions.
0 -
I'll probably move all of these documents out to an encrypted archive with a different pw that I don't keep in 1P.
@ChiliPalmer: If your system is compromised, the only way this approach would help is if you leave the data encrypted on disk and never access it, because once you do, you should assume that the 'new owner' of the machine will be able to access it as well.
I could make a locked PDF of my security questions, and keep that in 1P (pain to update though, and I'd have to keep the original somewhere, like in an encrypted DMG on my Mac).
The same applies here.
Store things in a file labelled "cards from my mother" - there's a fair chance an attacker would not steal that. Depending on your operating system, make the file that stores stuff invisible. Again this might not be found unless there was a keylogger as well.
This is really security by obscurity. It may foil a lazy or less-competent intruder, but if the machine is compromised, it would be trivial for them to dump all of your data and sift through it at their leisure. And maybe that's enough in most cases, but I'm not sure that I'd want to take that chance. And of course if you access this data on a compromised machine, you're essentially leading the attacker right to it and doing their work for them.
The good news: if someone simply dumps the contents of your hard drive, your 1Password data is encrypted, and with a long, strong, unique Master Password and PBKDF2, they're not going to be able to decrypt it.
The bad news: ultimately the best defense you have is to not give someone access to your machine in the first place. Practically speaking, there really isn't anything else you can do. Only install software from trusted sources. Don't give anyone access to your system. Don't run as administrator. Once malware is installed, it effectively has the same privileges you do, and can collect anything and everything and install other malware.
Knox does have a free trial, and is very useful for managing encrypted volumes, but, like 1Password, it won't protect you if you've got your vault open and someone snooping around in your computer. I hate to be so pessimistic, but when it comes to our most sensitive data, we really need to prepare for the worst.
0
