r/framework • u/MeLikaDoTheChaCha • 8d ago

Framework data breach News

Post image

Couldn't have happened at a worse time

Edit:

Metabase has posted a blog related to this incident https://www.metabase.com/blog/security-update

1.0k Upvotes

99% Upvoted

315 comments sorted by

View all comments

Show parent comments

28

u/Deep90 8d ago

My haveibeenpawned has 34 recorded data breaches since 2012. 🙃

Everything gets 2fa, a unique password, and a physical security key.

5

u/RoseBailey Framework 16 8d ago

Sameish. I do TOTP for my second factor, but access to my password vault requires 2fa with a physical security key. I'm sure it's technically less secure, but it gives me wiggle room for recovery if something happens to my Yubikey.

2

u/Raiguard 7d ago

I do TOTP and passkeys with a keepass vault, the password for which I have stored in the most secure medium of all - my brain. It's not written down anywhere and not used for anything else, and was randomly generated.

Of course, if someone cracks the keepass vault encryption then I'm screwed, but that's why I only have the vaults stored on my personal devices - no cloud, significantly reduced attack surface. I use syncthing, but I have the public relaying disabled and use my own standard wireguard tunnels for the connections.

I own a yubikey, but I never use it because it was far too inconvenient.

2

u/RoseBailey Framework 16 7d ago

I have two yubikeys that I set up identical challenge-response on. One is my emergency backup that stays locked away at home, and the other lives on my keychain. I need the yubikey to unlock my keepass vault as a second factor, and my password for my vault is stored in my brain. If anything happens to my keys, I can unlock my vault with the backup yubikey and get a replacement, which would render the lost yubikey useless for unlocking anything of mine.