cybersecurity

3249 readers

8 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Be kind
Limit promotional activities
Non-cybersecurity posts should be redirected to other communities within infosec.pub.

Enjoy!

founded 1 year ago

MODERATORS

[email protected]

Current account recovery best practices? (infosec.pub)

submitted 10 months ago by [email protected] to c/[email protected]

13 comments fedilink hide all child comments

Hi all,

Need to pick your brains for a bit regarding best practices for handling of account recovery issues while traveling.

Premise would be that my phone gets lost or stolen, and I may not have easy access to my laptop either, and being in a foreign country I couldn't easily get a copy of the original SIM to restore via OTP.

Consequently, I also don't really love the idea of using some password manager with a master password and no F2A.

Under those circumstances, what would you consider the best way forward to ensure accessibility without crippling myself in the process?

The only thing I can come up with is a random subdomain on one of my domains, with random username and random password, where I store an encrypted container containing txt-files. Maybe even further obscured with a random cypher (all numbers / letters shifted x positions to the right or something).

But there's gotta be other use-cases out there, so I was wondering what you are using?

Ideally something that doesn't involve another person.

Thanks!

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 10 months ago (1 children)

Yeah. They're all human readable but non-obvious instead of random strings. Stuff that's easy to remember but difficult to guess. You've just got to avoid typical patterns like 'randomwords526!!' or 'p00rex@mpl3'.

I do like to exercise that memory now and again, testing that I remember and that everything's functioning as it should. Just in case, theres instructions on paper in a safe place.

Being four separate item's minimum: subdomain, path, username, and password, none of which are published anywhere ofc; makes it pretty secure. The openVPN config/key needs a password as well, so 5 items.

[–] [email protected] 2 points 10 months ago

Right, I've taken a similar approach now. Unknown subdomain at an unknown domain which is not accessible from the web, only via ftp. FTP username and password are known only to me, long and obscure but not forgettable. Then a random subfolder-tree down in an outdated cgi-bin script. In the folder I've got a password protected zip archive with dropbox recovery codes, and in the dropbox finally my google codes in yet another password protected archive. All passwords different and never been in any reported breach.

That's gotta do it for now. Thanks a lot for your input!