Comment by solyin
2 days ago
How do you break back into your digital life? You wake up in a strange place. Something happened. Everything's gone. No wallet/keys/smartphone/tablet/laptop. How would you get back into your digital life given only a laptop with access to the Internet, unless something, somewhere is passwordauthenticate=yes.
> You wake up in a strange place. Something happened. Everything's gone. No wallet/keys/smartphone/tablet/laptop.
at this point the _last_ thing i care about is my email.
where am i? am i ok? how are my friends/loved ones?
once those are in place, it becomes clearer how to get back to "normal"
With nothing, how do you reach them? Your friends and loved ones are what's at the other end of the email/Internet access.
i guess if i have some sort of internet access (otherwise why would i be worrying about passwords), i'd set up a new account(s) and message those friends
The somewhere for password authentication is a place you have physical access. Not ssh.
There's been a natural disaster and your home is now inaccessible. With global warming going the way it has, that's looking more and more likely each day. Fires, hurricanes, earthquakes, war, tsunami, etc.
If access to a system is critical, I'm going to have some way to access the system other than SSH (out-of-band access through a BMC, serial port, or VM host) that doesn't exclusively rely on the same means of authentication.
On systems that receive regular updates, SSH can fail for many reasons other than authentication problems, after all.
PasswordAuthentication=no usually means that ssh stops directly reading /etc/passwd to authenticate, not that it stops accepting passwords completely. You'll still be able to log in with a correct password, provided KbdInteractiveAuthentication is still on, PAM is available, and the PAM policy allows for it.
The email at the root of my identity is tied to a country code domain in my country. There are robust legal processes for enforcing my status as the registrant and regaining control of it. Once I have access to that, I can use that to gain access to everything downstream.
Is it fast? No, but that's a feature.
But it does mean I get to lean on the existing processes and identity verification already part of the government bureaucracy and the courts as my backdoor.
A scenario where all the backups are gone and the server is somehow the only thing that survived is not a very plausible one.
Depends if you're backing up somewhere else online (also is that protected by 2FA?). You must not be in a place with many huge natural disasters.
And this is assuming the server is somewhere else on the cloud.
> You must not be in a place with many huge natural disasters.
Or I have proper backups synced across the world on different providers. The likelihood of everything failing is not a vector I worry about. If that happens I have bigger problems to worry about.
Remotely: An encrypted file with a seed / master passwords to all the other data, published under a public url you can remember, but not linked anywhere and not listed.
Locally: Same, but printed out, laminated, in a safe place with other documents.
I walk to my pc and type ssh-keygen. If i can’t do that I’ve got bigger problems. “I must be able to recover remotely using a memorised credential” is a terrible requirement.
You go travelling in a foreign country and get mugged. You have no phone no wallet no keys, just something you know and the goodwill of strangers.
> goodwill of strangers
Who can presumably get you in touch with the relevant embassy or consulate or, failing that, local authorities.
In that situation how will having ssh to my server help? I don’t have /usr/bin/international-rescue on any of my systems
Does this happen to you a lot? You may have other issues
Yeah your vault has password authentication. Your password manager in other words. Your vault is where you store your private ssh keys, and or the passwords for the keys.
I log in via console, either physical or virtual (the latter requires MFA though)
Sometimes you just have to start over. It’s not the end of the world.
1Password subscription and the memorized key. 1Password is the only place my ssh private keys are stored.
[flagged]
Avoid this kind of behavior on HN; we are not the community for attacking each other. Your comment is not helpful to further the conversation. You could have made a point about subscriptions being antithetical to the ethos of open source culture, but instead you attacked the user and mocked him/her.