[{"data":1,"prerenderedAt":269},["ShallowReactive",2],{"i-lucide:menu":3,"i-lucide:arrow-up-right":8,"i-lucide:moon":10,"i-lucide:sun":12,"i-lucide:rss":14,"i-simple-icons:github":16,"i-simple-icons:linkedin":18,"post-\u002F2014\u002Fsimple-and-secure-identity-protection-lastpass-yubikey":21,"surround-\u002F2014\u002Fsimple-and-secure-identity-protection-lastpass-yubikey":256,"i-lucide:arrow-left":265,"i-lucide:arrow-right":267},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M7 7h10v10M7 17L17 7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"4\"\u002F>\u003Cpath d=\"M12 2v2m0 16v2M4.93 4.93l1.41 1.41m11.32 11.32l1.41 1.41M2 12h2m16 0h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M4 11a9 9 0 0 1 9 9M4 4a16 16 0 0 1 16 16\"\u002F>\u003Ccircle cx=\"5\" cy=\"19\" r=\"1\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19,"hidden":20},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"id":22,"title":23,"body":24,"category":236,"comments":237,"date":238,"description":30,"excerpt":237,"extension":239,"image":237,"meta":240,"navigation":20,"path":241,"readingTime":242,"seo":243,"stem":244,"subtitle":237,"tags":245,"wordCount":254,"__hash__":255},"posts\u002F2014\u002Fsimple-and-secure-identity-protection-lastpass-yubikey.md","Simple And Secure Identity Protection: LastPass + YubiKey",{"type":25,"value":26,"toc":231},"minimark",[27,31,34,53,56,66,71,84,92,97,111,114,137,145,148,151,166,170,178,186,195,198,201,205,208,216,219],[28,29,30],"p",{},"How many online accounts do you have? How many of them use the same password? Is this password a simple word like 'Bananas123'? Thought so. Your're screwed.",[28,32,33],{},"If you're reading this post, you're probably an 'internet person', use many online services from banking to Facebook and let's face it, probably have insecure passwords to most of them. After years of hearing my friends moan about...",[35,36,37,41,44,47,50],"ol",{},[38,39,40],"li",{},"forgetting their password to a particular site",[38,42,43],{},"having to type a long password",[38,45,46],{},"not wanting to use a securer password since it's too complicated to remember",[38,48,49],{},"rejecting a semi-secure password I've generated for them (see #3)",[38,51,52],{},"getting hacked",[28,54,55],{},"... I realized that I too, have some of those problems. Most critically, my passwords aren't really that secure and could be brute-forced relatively quickly. In addition, I reuse my passwords (guilty).",[28,57,58,59,63],{},"The first step is realizing you have a problem. Time for solutions.",[60,61],"a",{"id":62},"more",[60,64],{"id":65},"more-4186",[67,68,70],"h1",{"id":69},"the-last-password-you-have-to-remember","The Last Password You Have To Remember",[28,72,73,74,78,79,83],{},"I've been using ",[60,75,77],{"href":76},"https:\u002F\u002Flastpass.com\u002F","LastPass"," (",[60,80,82],{"href":81},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=AXwdzWaf4RI","watch a video",") to manage and remember my passwords for years but so far, it's been a matter of convenience: automatically logging into places with the same password. Now, after seeing my friend write on Facebook that she got hacked, I finally had the required incentive to take action.",[28,85,86,87,91],{},"For three nights in a row, I went through all of my online accounts and changed the password to every last one of them. I honestly can not remember all of the services I've signed up to over the years, but luckily, my LastPass vault had a good overview, of more than fifty services. Some of them I no longer use and a fraction of them had a \"Delete account\" link, which I shamelessly clicked. Others got their passwords changed to a long, completely random string like \"",[88,89,90],"em",{},"orC+S9j7.k0!89aEUh?vVH5","\".",[93,94,96],"h2",{"id":95},"the-consequences","The Consequences",[35,98,99,102,105,108],{},[38,100,101],{},"I'm now an unattractive target to personalized password-stealing attacks (not using any guessable personal words + see #2)",[38,103,104],{},"Most large-scale brute-force attacks (trying do guess passwords from a list of password hashes) fail against my password: a large alphabet (letters, numbers, symbols), randomness and length (no password I generated is smaller than X characters, unless the service had a max length restriction)",[38,106,107],{},"Even if my password on some service is compromised, it has no effect on the rest of my accounts since no account shares a password with another account",[38,109,110],{},"I am now dependent on LastPass: I can not access any of my other accounts without first signing in to LastPass",[28,112,113],{},"This is all well and good, except...",[115,116,120,124,125,129,130],"blockquote",{"className":117,"lang":119},[118],"twitter-tweet","en",[60,121,123],{"href":122},"https:\u002F\u002Ftwitter.com\u002FYubico","@Yubico"," ",[60,126,128],{"href":127},"https:\u002F\u002Ftwitter.com\u002FSQrooted","@SQrooted"," As long your Passwords are stored in any kind of Cloud , it isnt really save...\n",[28,131,132,133],{},"— Archangel Blue 58 (@ArchangelBlue58) ",[60,134,136],{"href":135},"https:\u002F\u002Ftwitter.com\u002FArchangelBlue58\u002Fstatuses\u002F499305669443727360","August 12, 2014",[28,138,139,140,144],{},"There is now a single point of failure: LastPass. If my master password was compromised, LastPass turned out to ",[60,141,143],{"href":142},"http:\u002F\u002Fwww.dailymail.co.uk\u002Fnews\u002Farticle-2337863\u002FPRISM-Google-Facebook-DID-allow-NSA-access-data-talks-set-spying-rooms-despite-denials-Zuckerberg-Page-controversial-project.html","be evil"," or the password safe somehow got hacked, I'd be doomed.",[28,146,147],{},"From what I've read on the net on how LastPass operates and how they react to security breaches, I'm confident in trusting them with my safe of encrypted passwords. Yes, nothing is 100% secure, but you have to start trusting at some point.",[28,149,150],{},"As for keeping my master password safe:",[35,152,153,156,159],{},[38,154,155],{},"Use a secure (long, random) password",[38,157,158],{},"Take the usual precautions: don't log in from an untrusted source, don't let anyone see you type the password etc",[38,160,161,162],{},"Use ",[60,163,165],{"href":164},"http:\u002F\u002Fsearchsecurity.techtarget.com\u002Fdefinition\u002Ftwo-factor-authentication","two-factor authentication",[67,167,169],{"id":168},"two-factor-authentication","Two Factor Authentication",[28,171,172,173,177],{},"Most banks (except Estonian ones, for we have ",[60,174,176],{"href":175},"http:\u002F\u002Fwww.id.ee\u002Findex.php?id=30470","ID-cards",") require you to have some form of secondary identification, usually in the form of a code card. The same idea applies here: you have your password (something you know) and some form of a physical token (something you have). Login succeeds only when the two are used together, so when someone gets your password he can't log in because he does not have the physical token and when you lose your token the finder can not log in because he does not know your password.",[28,179,180,181,185],{},"There's a company out there that specializes in creating such tokens: enter ",[60,182,184],{"href":183},"http:\u002F\u002Fwww.yubico.com\u002F","YubiKey",".",[115,187,188],{},[28,189,190,191],{},"The rapid growth of online identity theft has exposed the vulnerabilities of logging with a username and password. Any information that is static, or stored on a device connected to the Internet, can be copied and misused by malware. Security experts agree that the best way to secure an online identity is to move out the user credentials to a separate device that is not connected to the Internet, and which generates a new and encrypted pass code every time it is used. Also, for strong two factor authentication it is recommended to combine the hardware authentication device with a PIN or a password – something you have + something you know. - ",[60,192,194],{"href":193},"http:\u002F\u002Fwww.yubico.com\u002Fabout\u002Fintro\u002Fyubikey\u002F","YubiKey Website",[28,196,197],{},"A YubiKey is a small USB device that goes into your USB port and fits on your key ring for portability. The basic premise is simple: you log into your LastPass vault with your master password and are required to provide a unique password, generated by YubiKey. Just insert the device, press a button and the YubiKey creates a random password on the spot for you to log in with.",[28,199,200],{},"This isn't a magical solution to all your online identity security problems, but using secure two factor authentication (which I consider YubiKey to be) and a good master password goes a long, long way, making less than sophisticated attacks against you fail (unless you're really foolish yourself).",[67,202,204],{"id":203},"so","So...",[28,206,207],{},"I am comfortable with my current state of security practices: I don't log in from public devices, have strong, unique passwords to every service I use and a secure way to access them through two-factor authentication.",[28,209,210,211,215],{},"If you a) have short, easy passwords or b) reuse passwords, you should really do something about that. After all, \"",[60,212,214],{"href":213},"http:\u002F\u002Flifehacker.com\u002F5785420\u002Fthe-only-secure-password-is-the-one-you-cant-remember","The Only Secure Password Is the One You Can’t Remember","\". You don't have to go all nuts, but I'd at least advise you to adopt LastPass (or similar) into your daily life and start generating random and secure(r) passwords for your services.",[28,217,218],{},"You will be glad you did this when you read another \"my account just got hacked\" post on your Facebook wall.",[28,220,221,222,226,227],{},"In case you're interested how to use LastPass with Yubikey: ",[60,223,225],{"href":224},"http:\u002F\u002Fwww.yubico.com\u002Fproducts\u002Fyubikey-hardware\u002Flastpass-yubikey\u002F","LastPass YubiKey",". Also, see ",[60,228,230],{"href":229},"http:\u002F\u002Fwww.ted.com\u002Ftalks\u002Florrie_faith_cranor_what_s_wrong_with_your_pa_w0rd","Lorrie Faith Cranor: What’s wrong with your pa$$w0rd?",{"title":232,"searchDepth":233,"depth":233,"links":234},"",2,[235],{"id":95,"depth":233,"text":96},"Writings",null,"2014-08-17","md",{},"\u002F2014\u002Fsimple-and-secure-identity-protection-lastpass-yubikey","about 5 minutes",{"title":23,"description":30},"2014\u002Fsimple-and-secure-identity-protection-lastpass-yubikey",[246,247,248,249,250,251,252,253],"privacy","security","password","lastpass","yubikey","two factor authentication","identity theft","token",1062,"X5HOlYGGDrEC7Tz0RqMMvl7sPn6rAMiYuriIqVyl3gA",[257,261],{"title":258,"path":259,"stem":260,"children":-1},"BoxOfWords - Arduino-Based Suggestion Generator for Improvisers","\u002F2014\u002Fboxofwords-arduino-based-suggestion-generator-for-improvisers","2014\u002Fboxofwords-arduino-based-suggestion-generator-for-improvisers",{"title":262,"path":263,"stem":264,"children":-1},"Vastus Nõusolekuta Otseturundusele","\u002F2014\u002Fvastus-nousolekuta-otseturundusele","2014\u002Fvastus-nousolekuta-otseturundusele",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":266},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":268},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",1790886934381]