42

The whole point of having a passphrase is to lock out anyone who does not know it. Allowing it to be recovered would defy the principle and allow hackers who get access to your certificate to recover your keys. So no, there is no such thing. What you should do is declare the keys as lost to the issuer so that they revoke your certificate. Then, you have to ...


22

Having a recovery option is perfectly fine as long as it is adequately secured. Whether you prefer losing your passwords if you lose the master password or want to trust the password manager company with access to your passwords is up to you. Keep in mind that security is a means to an end. There are always trade-offs to be made. You can have a perfectly ...


18

Likely the best option in this kind of scenario is to record the password/passphrase in a physically secure location (e.g. bank vault, safe deposit box). Relying on human memory to record this kind of information for 10+ years is an extremely bad idea. For example the person who knows the passphrase leaves the comapny/gets hit by a bus/forgets it. Writing ...


18

You need backup codes to "an account" not to Authenticator itself. Authenticator has one entry for each 2FA-enabled account of yourself - without needing an account for its own use. So the concept of backup codes for GA doesn't apply. If for example, you have an account (say GMail) that you've protected with GA-based 2FA, then you could generate backup ...


16

From your description, it sounds like the server is currently using the key, which means the server "knows" the pass phrase. If this is correct and you have appropriate access to the server, you should be able to extract it. How you'd do that depends on what the server software is and how it's set up. Just as an example, if you were running Apache, and it ...


11

Under some circumstances it may be possible to recover the private key with a new password. It would require the issuing CA to have created the certificate with support for private key recovery. This is normally not done, except where the key is used to encrypt information, e.g. when used for email or file encryption. The issuing CA should be able to tell ...


11

Yes, it is a slight security risk, for the reason Conor Mancone points out. But no, it does not mean that LastPass stores your master password on their servers, and would-be hackers need to do more than just obtain the recovery SMS. To use SMS recovery, you must have access to a computer and browser where you have previously used LastPass. LastPass ...


10

YES, the files are recoverable even when they are moved or deleted from the disks. Let's begin with how OS places files in the hard disks. Files are saved on the hard disk in small chunks. These chunks may be scattered all over, rather being placed in contiguous manner. Your File Manger of the Operating System keeps track of the files by knowing the ...


8

As far as our current knowledge goes, there is only brute force available. Ask the person who created the key to try to remember the passphrase and try. If this is not available, try a cracking program that generates popular passwords as a passphrase generator. However, when the passphrase was well chosen, your chances to crack the key are minimal.


8

This is kind of a who can I trust question. When you use a password manager, and specifically an online one, you do trust it. Admitedly, your password vault is stored in a securely encrypted form that can be decrypted with your private master key, and you trust the password manager to never leak that key - it need to know it at decryption time. For those who ...


8

This means the master password of the user is the only way to decrypt the data and it's is not stored anywhere. No, it doesn't. "Zero knowledge" means that no one at the company, much less a hacker, can decipher your data in anything less than brute force time, even if they're given the data on a silver platter. Your data is "stored," but in an encrypted ...


7

What you describe is the worst possible practice possible apart from just handing it over. From a security standpoint it poses significant risks to both the previous and current parties. The easiest way to reformat PCs is to use what is called a "golden image" this image is a windows image you: keep up to date only install the bare minimum of programs ...


7

I agree with you that the "philosophy" behind Google Authenticator's "only one device" is profoundly broken, because in as much as it tries to avoid "copying" the keys, it exposes you to the risk of a broken device. Electronic devices can fail. You need a backup. Happily, Google Authenticator's keys can be extracted: http://eduncan911.com/technology/...


6

The key needs to be revoked, the server nuked from orbit, and a new system with a new key put into place. To go further, this is why you want your master signing key to be offline and trust in your servers' certs based on that chain.


6

Oh dear. Sorry, but you goofed. You made a technical mistake and a legal mistake. You may be in trouble. Act carefully. The legal mistake is that just because you can take control of a machine, doesn't mean you're allowed to. Only the proper authority is allowed to decide who has the root password. From my understanding of what you wrote, you are not the ...


6

Note This answer discusses some important caveats to keep in mind for systems like this in general, but misses relevant details about the implementation of LastPass' recovery system. For more details specific to LastPass, see @korsbakken's excellent answer. The real risk Yes, it is a security risk, and it doesn't have to have anything to do with how they ...


6

You are viewing this from a security perspective and (I assume) from the perspective of a security practitioner. Assuming the company is in the business of making money, they will shut down the bare minimum required time because it will affect profits. IT will seldom have much input into whether or not they can remain offline while doing root cause analysis. ...


5

Yes, it is a good strategy if a disk has held sensitive data and may be accessible by others. A Google search for "wipe disk free space" finds numerous such tools. There are a couple of other considerations. One is "slack space." That's the unused space in the last cluster of a file. It's not part of free space, so it won't get wiped by many disk wiping ...


5

LastPass's documentation says to do the following to reset a password: If the [password] hint doesn't help, go to the Account Recovery page to activate your local One Time Password. This allows you to change your Master Password if you've logged into LastPass previously on that computer, and is the only way to 'reset your password'. You should try this on ...


4

As I said, full marks to @JeffClayton for using an e-mail account EXCLUSIVELY for password recovery. However, for added security: Every month, install a new version of TAILS to a USB drive. Use TAILS to make the account, and TAILS to access it. As soon as you have the fresh TAILS install on the drive, boot it up and change your password (that's every month)....


4

I would not consider using a family member or friend's email to be a good idea, for reasons you mention yourself or simply if they ever change a password. I would create a new email address and use that, but for no other purpose. That way you would also not be putting others at risk. 2-Factor is not a bad idea. The harder you make it for an attacker to ...


4

There are three main types of storage drives. Hard disk drives, solid state drives, and solid state hybrid drives. Each of them behaves differently. Hard Disk Drives When you delete a file, you unlink it, effectively telling the filesystem that the sectors in which the file resides are no longer in use and are free to be overwritten. When this happens, the ...


4

There is a misconception in your question regarding the attack techniques and exploits that are used in these spectacular and widely-known security incidents. Exploits are usually categorized with metrics (upon others) like severity and complexity. Usually(!) the more complex an attack the harder the forensics that are involved to figure out what exactly ...


4

Yes, Intrusion Detection and Digital Forensics have components that can be automated for quick triage on large-scale installations in very diverse technology infrastructures and complex global organizations. Incident Response and Crisis Management are more-difficult, which often include the onus to Pull The Plug, or go offline -- especially during a root-...


4

It looks like you are combining a few different concepts into one: copy validation, testing of restoration procedures, and fully restoring the entire enterprise. And It also looks like you are combining the difficultly of restoring data files and entire infrastructures. We need to pull this question apart. Checksums are for validation of the integrity of the ...


3

If you do not have access to the source code, you will have to make multiple attempts to see if there are any patterns in the token generation. If it is a basic incrementor, this may be easy to defeat. You can take the length of the token into account as well. Here are some OWASP guides on the topic, which may be of use: Testing for weak password change ...


3

Just to offer an alternative view, I'd say it is most certainly possible. However, it is most probably not practical at all. Process is known as cracking, and usually involves either a brute force attack or dictionary based one (perhaps helped with newly detected algorithm weaknesses) . Depending on complexity of passphrase used and your computing power ...


3

The reason DBAN or such erasure software, wont beat the investigators, is that when they find out a drive is erased (zero:ed), this will count as destruction of evidence, which is punishable. Thus, its enough that the investigators prove that the drive has been intentionally erased. It depends on country, but in most countries that employ the "forbidden ...


3

It depends on the geographic scope of the threat that you are trying to mitigate balanced with the costs and impact of distance on operations and recovery. If the main site is in a drought-prone wooded forest with dry grasslands, you'd want your DR site beyond the fire zone. If the main site is in an earthquake zone, you'd want your DR outside of that zone....


3

Unallocated space of all zeroes is common in a new or cleaned drive. A used drive will generally have left over fragments and deleted files. Zeroes are zeroes, there is no recovering a previous value. When people speak of recovering files, they are referring to reconstructing actual data from the unallocated space. You apparently don't have any data to ...


Only top voted, non community-wiki answers of a minimum length are eligible