• 0 Posts
  • 30 Comments
Joined 1 month ago
cake
Cake day: June 11th, 2024

help-circle
  • Who said you shouldn’t be able to access your backups remotely?

    A lot of tools allow you to set up google drive, drop box, whatever. Yes, this brings you back to cloud, but it’s better to have a hacker wonder if some random google drive might have juicy auth data than know for sure that some SaaS platform absolutely does. Also, even if they got the file, it should be encrypted, and should be a massive pain to get into (at least long enough to change the passwords stored in the file).

    The other (better) option is to have it back up to sftp (or similar), which you manage yourself on private servers. Normally this would be accessed through RSA and/or TOTP, but you can set up secure backup methods (combo any/all of; port knocking, long-password, human-knowable timed password, biometrics, security questions, other trusted humans that have some TOTP that can’t open your storage alone, etc).



  • Stop. Trusting. Cloud/SAAS. Security. Apps.

    Don’t give them your passwords and private keys, because you can never know of they’re being stored responsibly, or who has access to them.

    Don’t give them your personal details, they don’t care about protecting user anonymity.

    Keep your keys and passwords in local, encrypted files, and generate your TOTPs locally.

    “But that’s not convenient!” - It’s plenty convenient, find an app that supports your phone’s biometrics. There are plenty on both Android and iPhone that also work in Windows/MacOS/Linux.

    “What if I lose my phone?” - Keep your files backed up. If you don’t do this, you deserve to get locked out. Fear of losing data is a good thing, it keeps you vigilant. Apathy gets you another of these stories.

    There are plenty of apps that encrypt local storage for security keys and code generation. Stop allowing these tech bros to create honeypots, and making you pay them for the privilege of being an easy target.


  • It’s not harmful to tell average people who run windows to disable updates, because you can’t disable the updates as a single-license scrub.

    (Theres usually some hacky bullshit to delay or block updates, but they break constantly and you have to keep finding new ones, because Microsoft thinks of their userbase as stupid babies who can’t be trusted with their own hardware).

    Also, you live in your own personal slice of Windows control with your hundreds/thousands of systems being managed with group policies. I have no doubt that you don’t see issues, because your company chose a few models of laptop or desktop and know how they’ll react to the updates. You can turn off the annoying shit, and choose specific updates at specific times. Microsoft doesn’t want to piss off their corporate customers, especially the ones with massive spending contracts with Dell/HP/Lenovo.

    Thing is, outside of you - and your groups of other corporate windows admins - the general user (with varied hardware/software configurations) don’t have the safety of catching issues on a few test machines and delaying a deploy to the fleet, or even the option to delay updates at all, and they’re screwed over constantly by random broken drivers, system setting that aren’t respected between updates, and bloat/backdoors that you can’t opt out of.

    It is you who is being disingenuous, by suggesting that the windows update system has no flaws, because you operate in an extremely controlled environment with tons of safeguards and - ironically - way more autonomy.