Is it bad to have the same 2FA PIN on two secondary profiles?

gk7ncklxlts99w1

Looks like you updated your post after I already responded.

Perhaps I didn't give enough info about my use case.

My question is mainly addressing a physical security threat. I'm not so worried about privacy (separating Google services from FOSS for example).

I don't use antivirus. I just compared it to password reuse as one of the golden rules (if you're using Linux, this rule doesn't really apply).

gk7ncklxlts99w1

raccoondad Well, "sensitive data storage" does apply here. Not sure if I mentioned it already - I use one profile as my main, with the other profile for email and Bitwarden. Those two things are very sensitive.

raccoondad

gk7ncklxlts99w1 Oh, yeah that is very different. A lot of people use profiles for google service sandbox encapsulation (I moved to private spaces for that mostly), which can end up being less sensitive than the owner profile. At that point I question using a different PIN, especially if there isn't an important Google account linked to it.

Use a different pin, consider 2FA, its hard to say if it matters to use different pins for the 2FA pin because that requires your actual finger. Realistically, the only time they would have your fingerprint would be if they were to force you to authenticate for them, which you can take as you will for security implications.

As for the main pin, I like to avoid remembering the actual code and go with the pattern, it helps.

raccoondad

gk7ncklxlts99w1

"Anyone who is a systems administrator would know how much of a major threat password re-use is."

This is phrasing it like I am saying to always reuse the same password and not to consider the aspects of what you are doing with each profile and what you are expecting in both security/authentication/privacy. As I said, the same reason private space can outright to copy over credentials.

"If you're reusing your passwords, you have a problem no matter how you justify it."

I fail to see this when GOS and ASOP explicitly allow you to copy over credentials to a private space (which is basically just another profile.), unless the implication is that GOS/ASOP are trying to push insecure practices.

" In what situation would reusing these PINs lead to compromise, and how likely is that?"

2FA pins are only valid after fingerprint authentication, so ideally a 2FA PIN compromise would be easy to prevent attacks with assuming they don't have your fingerprint. They would need to access the owners pin first assuming the device is in BFU

gk7ncklxlts99w1

raccoondad

I fail to see this when GOS and ASOP explicitly allow you to copy over credentials to a private space (which is basically just another profile.), unless the implication is that GOS/ASOP are trying to push insecure practices.

By copying over, you simply mean "reuse" right? Allowing and pushing are different things. You should be allowed to compromise your own security, but having that behaviour encouraged is different. I should be allowed to use a terrible password if I want to.

2FA pins are only valid after fingerprint authentication, so ideally a 2FA PIN compromise would be easy to prevent attacks with assuming they don't have your fingerprint. They would need to access the owners pin first assuming the device is in BFU

So, tl;dr according to you - as long as you're using 2FA you should be good?

gk7ncklxlts99w1

raccoondad

Oh, yeah that is very different. A lot of people use profiles for google service sandbox encapsulation (I moved to private spaces for that mostly), which can end up being less sensitive than the owner profile.

Are you using private spaces and profiles synonymously here?

Use a different pin, consider 2FA, its hard to say if it matters to use different pins for the 2FA pin because that requires your actual finger. Realistically, the only time they would have your fingerprint would be if they were to force you to authenticate for them, which you can take as you will for security implications.

A duress password would address that problem. And given you need my fingerprint to unlock either profile, it would only be under duress that you could compromise either profile, regardless of whether I have a different 2FA PIN or not. In that case, seems like having different PINs would not help me, in any situation really.

As for the main pin, I like to avoid remembering the actual code and go with the pattern, it helps.

You mean instead of using a PIN or password, to use a pattern unlock? I didn't know that was an option for the primary unlock method.

raccoondad

gk7ncklxlts99w1

"but having that behaviour encouraged is different", yes but you could do that anyways by reusing the password during setup, ASOP explicitly put a 'use the same password/finger' option. If I am not mistaken GOS puts 'use no password' in the setup screen in tiny text to have you avoid even thinking about it, while the copying credentials option is fairly 'out there' (As seen here at 3:50 https://www.youtube.com/watch?v=Hd4d72JmKKU)

"as long as you're using 2FA you should be good?"

That is for you to decide, but 2FA can make it harder in general to access the device with the added authentication measure.

gk7ncklxlts99w1

raccoondad

ASOP explicitly put a 'use the same password/finger' option.

Not sure what you're referring to

raccoondad

gk7ncklxlts99w1 "You mean instead of using a PIN or password, to use a pattern unlock?", no I just keep in mind the pattern of the pin code rather than memorize numbers. Sadly pattern unlock is not secure according to GOS.

"Not sure what you're referring to", private space initalization

gk7ncklxlts99w1

raccoondad

no I just keep in mind the pattern of the pin code rather than memorize numbers.

seems complicated to me, but you do you.

ryrona

For what it is worth, this is what I am doing:

Disk encryption passphrase: I use the same passphrase for all my private devices (computers, phones, USB drives). This includes that I use the same passphrase for all profiles or encrypted partitions on a single device. Advantage: I only need to remember a single passphrase, so I can choose to remember a really strong one, and there is low risk I will forget the passphrase. Disadvantage: If I would mistype the passphrase into an untrusted system, I have now leaked the passphrase for all my private devices and profiles and partitions and external USB drives, not just one.

Secondary authentication: I use the same password for all screen locks on computers, and same fingerprint+PIN for all screen locks on phones. This does not matter much, it is only secondary authentication. The passwords and PINs are short, but not so short they can be easily guessed by a determined attacker typing in things manually. Advantage: Again, easy to remember and really fast to type. Disadvantage: None really.

Online accounts: I use a randomly generated password per website or account. No password is ever shared. I specifically do not memorize these passwords, and use a separate password manager for each compartmentalized security domain for the passwords that should be available in that security domain. Advantage: A website being hacked and having passwords leaked will not compromise my accounts on any other website. No risk of me accidentally logging in on the wrong online account in the wrong security domain. No need to remember anything. Disadvantage: None really.

I am a security and privacy expert, and activist for the heavily oppressed minority I belong to, since over 10 years.

Murcielago

ryrona

Sounds like a well-balanced strategy to me that fits your threat model. Thanks for the detailed insight!

gk7ncklxlts99w1

ryrona

Thanks for sharing your setup, it's very helpful. I have a very similar setup to you. I use the same strong passphrase for my LUKS encrypted disks and partitions, and for backup repositories for those same disks (using restic or borg). I also reuse my device login credentials for my computers and laptop. I use an Onlykey which is really handy, I use it for logging into commonly accessed online accounts, and for entering my device logins and disk encryption passphrase. It only has 24 slots, which is better than nothing but I wish there were more. Were I to use a unique passphrase for each disk, and a unique login password for each device, and a unique password for backup repositories and a few veracrypt volumes, it would easily take up all 24 slots. And the Onlykey doesn't really work for unlocking phone profiles (not unless I enable USB data transfer while locked, which I won't).

It sounds like password reuse is inevitable for this use case, without excessively overcomlicating my setup and possibly lead to human error. KISS basically.

ryrona

gk7ncklxlts99w1 I use an Onlykey which is really handy, I use it for logging into commonly accessed online accounts, and for entering my device logins and disk encryption passphrase.

As long as you are aware that if you have your disk encryption passphrase stored on a hardware security key, you have reduced the security of the disk encryption from that of a strong passphrase to that of breaking into the hardware security key.

DeletedUser237

gk7ncklxlts99w1 how insecure is it to use the same fingerprint + PIN

Depends on the settings you chose, it does not immediately scream insecure, but it may be less secure.

Is it bad to have the same 2FA PIN on two secondary profiles?

That's something only you can answer. How easy is it to reconstruct it? How much you value convenience over "maximum" security? Use the phone as you find the most suitable for your needs. Don't get caught into "of you don't do X" you will get popped mindset. People claiming this have no deep understanding and just parrot what they read or heard from "YouTube influencers"...

gk7ncklxlts99w1

DeletedUser237

Don't get caught into "of you don't do X" you will get popped mindset. People claiming this have no deep understanding and just parrot what they read or heard from "YouTube influencers"...

I completely agree and definitely understand it. It's a cognitive fallacy, the all or nothing mindset.

I already came to the conclusion earlier that having fingerprint + 2FA PIN on multiple profiles, along with a duress password on both, is identical in security to having unique 2FA PINs. A unique 2FA PIN would not help in any situation because they would only be able to compromise those profiles under duress (because they need my fingerprint), and a duress password addresses that concern. Actually, there is one scenario where a unique 2FA pin would help - where they observed me entering a PIN for one profile, sever my thumb or knock me out, and then attempt to use the same PIN on another profile. At that point I have bigger problems.

Reusing passwords and passphrases on other things, like LUKS disk encryption and such, is a more complicated scenario.

Small side note: People underestimate reasoning when crafting threat models - and I'm not bashing you or anything here - but it's easy to say "you must identify whether or not this comes within your threat model" but when a person is asking for help in a privacy or security community, what they're really doing is asking for help crafting their threat model, and get feedback on it. Threat models can and should evolve in light of new information. A threat model without being subject to new information is a closed system that can be likened to a paranoid set of beliefs. We need other people to update our threat models - we shouldn't work on it alone.

gk7ncklxlts99w1

ryrona

The hardware security key is very secure, and I protect it with a PIN. It provides a substantial amount of convenience while allowing me to use a stronger passphrase - were I to rely on my memory alone, I would naturally reduce the strength of the passphrase to make it easier to type. Keeping my passphrase saved on a hardware key is not a weakness in my setup, it's a strength.

DeletedUser237

gk7ncklxlts99w1 The hardware security key is very secure

How did you verify this? not challenging you or anything, I did a quick search on them, as this is the first time I heard about them (I have few different Fido compliant keys) but I am always interested in testing stuff like this.

ryrona

gk7ncklxlts99w1 and I protect it with a PIN

So, someone who has access to your hardware security key, and can brute-force your PIN, can unlock your encrypted disks? I guess your PIN is far far shorter than the disk encryption passphrase? Then you have reduced the algorithmic strength of the protection to that of the PIN code. In best case, your hardware security key throttles PIN input attempts heavily, and the actual disk encryption passphrase is encrypted with a key derived from your PIN. In worst case, and the more likely case, the adversary has an exploit against your hardware security key that allows them to extract your disk encryption passphrase, even without knowing your PIN. It seems like most security chips have their security broken within a few years from release anyway, but algorithmic strength of a disk encryption passphrase should be able to keep your data secure for well over 20 years.

I am not saying the security key is wrong in your threat model, as long as you are aware in what way you have reduced the security, and accepts those tradeoffs. That is all.

gk7ncklxlts99w1

DeletedUser237

I cannot verify it 100% because I'm not qualified to audit them. But I have used some common sense and read about how it works and the various technologies they have used. As an example, they use epoxy as an anti-tampering mechanism to protect the HSM (hardware security module). I also have a couple of hardware encrypted USBs, and when I did research for these things (cause they're very expensive) I learned a lot about how these things are built, and OnlyKey would be adopting many of these things.

It also provides plausible deniability if you configure it the right way - there's a mechanism that allows you to hide the existence (or provide plausible deniability for the existence of) a second profile.

I'll leave the rest up to you, this is just what I remember off the top of my head. Realistically, I have no way to verify whether anything I use is actually secure, but OnlyKey is pretty low on the list of my worries. I think the hardware is solid, but my only concern might be their software implementation.

JollyRancher

gk7ncklxlts99w1

As with everything dealing with security, it starts with your threat model.

Ideally, for maximal security, you should use a different strong password for every profile that you only enter when you can ensure no shoulder surfing and 2fa secondary unlock with a 6 digit pin for other circumstances. Using a different pin for every profile.

In practice, set up a high security profile with a unique strong password & pin. Use this for anything you need to remain perpetually secure against well resourced adversaries.

You may also want to do this for the Owner profile.

For less secure daily driver profiles where you are using different profiles to better sandbox/control apps, using the same unlock method(s) for them all isn't really an issue. You should just treat all those profiles as if they are one and assume that if any of them are compromised, all of them are.

gk7ncklxlts99w1

JollyRancher

As I discussed earlier, and I was able to answer my own question, there's no reason to have a unique 2FA PIN for different profiles because there is no realistic attack scenario, assuming I have a duress password enabled, where that would help except where they obtain the PIN and then remove my thumb. Unique primary PIN is a different story.

In practice, it doesn't make much sense to me to organise my profiles based on threat model. Rather, I organise them on use case (I currently have Owner which has nothing in it, a secondary profile which has nearly everything, and another which only has email). Reason is usability. If I create a high threat model profile, what am I going to put in it and how will I use it?

My most sensitive data would be my email and password manager. Lets say I don't use either of those very often - since I'd be using a very strong password or long PIN, and I probably won't be using any 2FA unlock (since that would be pointless unless I was using the profile often), I would need to be able to remember the password/pin for it to be usable but since I don't use it often it will be hard to remember, and I have limited memory bandwidth. I'd be relying on having the password written down somewhere. Another issue is those two apps (email and password manager) maybe shouldn't go together - the profile on which I use for email could be the most susceptible to malware (due to email attachments), which could lead to a compromise of my password manager.

I have to take a more dynamic approach, than just designate profiles by security level.