So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and finally up the security of my authentication in password-protected computer systems. My goals were to...
- Use unique passwords for every password-protected service which I have access to
- Make them as resilient to guessing, brute force, and dictionary attacks as practically feasible
- Use two-factor authentification based on something I have whenever feasible
- Avoid relying too much on the availability of a specific computer (e.g. cellphone), object or service (e.g. network coverage), basically stuff that can easily be broken and stolen
- Automate any kind of data synchronization that is required
I came up with a scheme which I am pretty satisfied with, but I would like to check with someone more experienced that I fully understand its strengths and weaknesses. And this is where I need your expert help, if you have some time to help me with that. Of course, feel free to reuse that procedure for yourself too, there's no copyright on it.
So here goes :
- In the general case where I have access to a trusted computer with an Internet connection and a USB port, I use LastPass to generate, manage and sync random per-service passwords, with a strong master password and a Yubikey as a second factor of authentication. 2FA is enabled for services that support it in a sane way.
- For cases where trusted computers or network connections are not available, I have also configured Lastpass to accept offline logins on my cellphone, using only the master password. Two-factor authentication is maintained by configuring Lastpass to only accept online logins from this cellphone's UUID.
- Finally, for logging into computer sessions, including my cellphone, I chose to assume the availability of no software tool, and use passphrases. These passphrases are generated in my head based on service identification and stuff that is ridiculous enough that I will remember it. Fake examples of such could be "HeyAmigo!IDonQuichoteDemandAccessToThisMac" or "OMG!Raptors!ToTheUNIXSystem!".
Now, no system is perfectly secure, of course, which is why I wanted to be sure that I understand where the weak points of this authentication scheme lie :
- As with any password manager, I need to pick a very good master password for LastPass, as the incentive for cracking it is high.
- I need to trust the LastPass client to be secure on any platform, in sense of working as advertised (e.g. generating truly random passwords) and leaking no sensitive data.
- I need to trust my YubiKey's write-only access scheme to be effective, and the Yubico servers not to leak my AES key, for YubiKey authentication to remain secure.
- My trusted computers, including my cellphone, need to be devoid of keyloggers and other kinds of malware which would be able to intercept LastPass' master and service passwords.
- LastPass' cellphone UUID mechanism, for which I have found no technical documentation, must be secure : IDs need to be actually unique, and forging them needs to be infeasible.
- My login passphrase mechanism is probably less secure than the randomly generated passwords which I use elsewhere. With long passphrases (10 words or more, including uncommon ones), I trust it to be invulnerable to brute force and dictionary attacks, but it may be vulnerable to guessing from someone who knows me. So it may be hardened enough for local login, where I also have a second factor of authentication (physical access to the machine), but for remote access I might want something stronger.
Do you think I got it right, or see another weak point in my authentication scheme that I might want to be wary about and try to harden in the future ?