How important is it to not reuse login credentials across devices (locally)?

embroider_unknotted344

This isn't GrapheneOS specific.

Say you have multiple computers including a laptop, a phone (obviously), and you encrypt disks, whether using FDE or partitions.

Should you be using different login user/password for each device?
Should you use different passwords/passphrases for your disk encryption?

Password reuse is often talked about with online accounts but rarely discussed in the context of local stuff. There's no risk of credential stuffing for example. The only threat I can think of is a physical adversary, one that uses methods like shoulder surfing.

Also a password manager doesn't help in this scenario. You can't use a password manager for logins, or for full disk encryption of a host. Really makes having different passwords and usernames complicated.

NoahRaketic

embroider_unknotted344 It really depends. If both your computer and your phone are equally trusted and have access to the same data, you're correct that it doesn't make much of a difference.

There can be an advantage to having a separate credential if your phone is more trusted than your computer, or if one computer is more/less trusted than another. There are many side channels to grabbing someone's password on the desktop that don't apply to phones.

embroider_unknotted344 The only threat I can think of is a physical adversary, one that uses methods like shoulder surfing.

This isn't entirely accurate. If your computer is fully remotely compromised and you use traditional software-based password checking, then an attacker can take the hash and the salt of that password and brute-force it offline. The same is true for LUKS headers.

embroider_unknotted344 You can't use a password manager for logins, or for full disk encryption of a host.

It is possible to do this. As an example, I have a password manager on my phone which contains the disk encryption passwords for my other devices.

DohnJoe

embroider_unknotted344 Should you be using different login user/password for each device?
Should you use different passwords/passphrases for your disk encryption?

I would for sure have a different passwords for encryption and user login.
They serve two different purposes and suffer different attacks.

NoahRaketic If both your computer and your phone are equally trusted and have access to the same data, you're correct that it doesn't make much of a difference.

I somewhat agree, but I would add that also the software running on the devices might change the odds.
Just as simple example, if the laptop is a *nix machine with sudo or equivalent, leaking the password will give an attacker not only more possibilities on the local machine, but also more power over the network and/or other vectors.

Generally speaking I would use different credentials everytime, this will help you building stronger habits when for different scenarios where different passwords matter more (like for online accounts et similia).

I would also save them on the password manager.
You might not copy/paste them, but you can still use them as reference instead of relying on your memory.

DohnJoe

embroider_unknotted344 Sorry but, how is a password generator relevant to my question?

The answer is relevant because having a complex password you can remember it's good and helps you in having different password for everything.

embroider_unknotted344 That's what you're saying?

embroider_unknotted344 that is not what I am asking.

embroider_unknotted344 Once again we are not discussing online accounts here.

embroider_unknotted344 credentials that are saved on another device,

Generally speaking I feel like there is a little bit of confusion, and I apologize fir not being clearer.
I'll try my best to answer your direct answer and leave less space for interpretation.

Yes, I would use different passwords for every local account.
On top of that, I would use a different (third) password also for disk encryption.
Maybe you didn't explicitly asked for it, but I feel like context matters and anyway you specified the following:

embroider_unknotted344 You can't use a password manager for logins, or for full disk encryption of a host.

Finally, the reason why you should have the password on the password manager is just to make sure that you are not locked out, but this doesn't mean that you need to read the password from the other device every time you have to input a password.

If you follow @Novalissoide advice you can came up with strong passwords you can remember, so you don't actually need to type the password looking another device.

If your password is Correct Battery Horse Stapler you don;t need your password manager to remember it.

DohnJoe

I cannot edit my answer anymore, so I will add some more context here

embroider_unknotted344 Once again we are not discussing online accounts here.

I was not discussing online accounts.
My argument is just: If you build good habits where it matters less (local accounts), you will follow the same habits where it matters more (online accounts).
It's like quoting all variables in your shell even when you don't have spaces in the value, you will benefit on the long run because of the built habit.

embroider_unknotted344 Should you use different passwords/passphrases for your disk encryption?

embroider_unknotted344 If you mean you would use a different password between your login and disk encryption, that is not what I am asking.

Ok?

When I said:

DohnJoe You might not copy/paste them, but you can still use them as reference instead of relying on your memory.

I was not implying you should never rely on your memory.
I could have been more clear and I will be now: You can have a good rememberable password you can type yourself plus having that stored in the password manager for those days you might forget.

embroider_unknotted344

NoahRaketic

There can be an advantage to having a separate credential if your phone is more trusted than your computer, or if one computer is more/less trusted than another.

How about in a scenario where you use a laptop publicly, say at school, where you expect to be around people. I don't like the idea of my credentials being observed by someone if I use those same credentials at home.

This isn't entirely accurate. If your computer is fully remotely compromised and you use traditional software-based password checking, then an attacker can take the hash and the salt of that password and brute-force it offline. The same is true for LUKS headers.

I was operating under the assumption that I'm not already compromised. If we go along with this scenario, would having different login credentials on different devices on the same network help much against a remote adversary who has compromised one of the devices? If they have to resort to brute forcing my login credentials on one device, they will likely use the same method on other devices, but they'll likely not get that far since my password is quite strong.

It is possible to do this. As an example, I have a password manager on my phone which contains the disk encryption passwords for my other devices.

You're gonna have to explain that one. How exactly do you enter your desktop login credentials or disk encryption passwords from your phone to your desktop? Note that I am talking specifically about copying/pasting or some other method like an OnlyKey (which I have by the way), I'm not talking about merely storing said passwords.

NoahRaketic

embroider_unknotted344 How about in a scenario where you use a laptop publicly, say at school, where you expect to be around people. I don't like the idea of my credentials being observed by someone if I use those same credentials at home.

That sounds like a good use case to reduce trust in that laptop and use different credentials.

embroider_unknotted344 If we go along with this scenario, would having different login credentials on different devices on the same network help much against a remote adversary who has compromised one of the devices?

I'm mainly pointing out one way the password could get compromised remotely in the first place. This would have to be followed up by a physical attack most likely, but there are some remote attack vectors it opens up, like privilege escalation if the attacker can achieve code execution. But simply being on the same network doesn't have much to do with that (unless you're exposing SSH with password auth).

embroider_unknotted344 How exactly do you enter your desktop login credentials or disk encryption passwords from your phone to your desktop?

I'm not aware of any way to copy/paste credentials, I'm sorry. Having a password manager on the phone in this case eliminates the aspect of having to remember many different passwords, but the effort of typing it still remains. There most likely are ways, though, as you've mentioned.

embroider_unknotted344

NoahRaketic

I'm not aware of any way to copy/paste credentials, I'm sorry. Having a password manager on the phone in this case eliminates the aspect of having to remember many different passwords, but the effort of typing it still remains. There most likely are ways, though, as you've mentioned.

That's what I was referring to earlier when you said it was possible to do.

Novalissoide

embroider_unknotted344
One way to get better pass phrases for typing in is what this app do.

https://github.com/v4lpt/PWG/releases

It generates human readable, non-diceware made up words that is not found in a dictionary. A sort of middle ground between convenient and super-entropy.
It has some drawbacks, but i haven't seen any other like it.

embroider_unknotted344

Novalissoide

Sorry but, how is a password generator relevant to my question? I'm asking a specific question, whether you should use different passwords as your login credentials across devices, and whether you should use different passwords for your various disks. Not asking about how to make a password, I already know how to do that.

DohnJoe

I would for sure have a different passwords for encryption and user login.
They serve two different purposes and suffer different attacks.

Just to be clear, you would use a different login password between 2 different devices, and a different encryption password for different disks? That's what you're saying?

If you mean you would use a different password between your login and disk encryption, that is not what I am asking.

Generally speaking I would use different credentials everytime, this will help you building stronger habits when for different scenarios where different passwords matter more (like for online accounts et similia).

Once again we are not discussing online accounts here. Unique passwords for online accounts is a given, anyone on this forum should already know this.

I would also save them on the password manager.
You might not copy/paste them, but you can still use them as reference instead of relying on your memory.

Extremely difficult in practice if you've actually tried doing this. Are you saying you would be comfortable decrypting your disks and logging into your devices using credentials that are saved on another device, and manually inputting them? Try actually doing that, and see how inconvenient that is.

Personally my solution is this. I currently use the same password across different computers, though the username is different. My laptop has a unique diceware encryption passphrase while my other computers at home have the same diceware passphrase. I've memorised all passwords.

embroider_unknotted344

(can't edit my previous post)

I apologise if I come across as rude here, I'm just tired of people misunderstanding what I'm asking.

To add to my last comment, I use an OnlyKey for passphrase disk encryption input and login, and whenever I'm asked for sudo. Though it has a timeout, so I end up entering my user password manually most of the time.

The onlykey handles long disk encryption passphrases (which I memorise, just in case, and it's also saved to my password manager, so the onlykey just acts like a keyboard not a password manager), while I have a strong yet memorable login password.

So I'm left wondering if I should have a different login password for different devices, and different disk encryption passphrases across my different disks (besides my laptop which is unique already), and whether doing so would be security theatre or if it would actually be advantageous. I can only see a physical adversary being relevant in this scenario.

Johnnyloans

embroider_unknotted344

Most people's threat model is low. You said the only threat you can foresee is someone looking over your shoulder.
Disk encryption, I would set these all to the same password.
User accounts, different password from disk encryption. All the same or slightly different, your preference.
I use the same password but slightly different, related to the hostname, so I don't accidentally sudo on the wrong machine.

You said you use different usernames on devices. So the login credentials aren't identical on your network if you use the same password.

If you aren't worried about my points, same password for user accounts is fine in my opinion.
Actually, another scenario, you tell someone the password to one device and now they know the password to everything.

For a low threat model, I don't think it matters too much. Although, since you have disk encryption, maybe you are worried.

Most people don't benefit from disk encryption. Does nothing while the system is booted up (doesn't stop hacks/malware). It creates recovery hurdles. If you're worried about a stolen/lost device or breaking-and-entering, understandable.

relevant xkcd on passwords
https://xkcd.com/538/

Novalissoide

embroider_unknotted344 apologise if I come across as rude here

No worries.

embroider_unknotted344 different login password for different devices, and different disk encryption passphrases across my different disks (besides my laptop which is unique already), and whether doing so would be security theatre or if it would actually be advantageous. I can only see a physical adversary being relevant

It could be a kind of sandboxing, but a good setup could work for several devices with one strong passphrase. I would prefer this over several weak 'convenient' passphrases.

Bottom line:
Individual passphrases but only if not at the price of them being shorter for human convenience.
Single passphrase if that's what's needed for the human user to handle a strong passphrase, it is the safer compromise.

@embroider_unknotted344
@DohnJoe
@Johnnyloans

You all make good points. 🫡👍

embroider_unknotted344

Johnnyloans

User accounts, different password from disk encryption. All the same or slightly different, your preference. I use the same password but slightly different, related to the hostname, so I don't accidentally sudo on the wrong machine.

I usually avoid doing this, having a password template and salting it with a non-random string that can be easily guessed. It might be better than having an identical password but not by much. It makes it harder to type more than it makes it secure.

You said you use different usernames on devices. So the login credentials aren't identical on your network if you use the same password.

Username is the same as the device name. Different usernames don't really provide much security in this context, I'm pretty sure you could figure that out with a simple nmap query.

I don't put a whole lot of stock in threat modelling. There's no such thing as a "low" or "high" threat model and in the context of online discussions, there is no way to reliably convey what your threat model is as a whole. Instead, it's better to discuss specific attacks and what specific defenses are sane for that attack. Getting into one's larger threat model just obfuscates the discussion.

Most people don't benefit from disk encryption

So long as people have data they want hidden, and others who want that data who also know they have it, people will benefit from it. It becomes a question of whether they can responsibly handle that added layer of defense without falling victim to user error.

Since disk encryption can be applied to non-system disks, you can still have disks that are encrypted while the host is active. You just have to remember to turn off the disk (or lock it) when not in use.

embroider_unknotted344

DohnJoe

My argument is just: If you build good habits where it matters less (local accounts), you will follow the same habits where it matters more (online accounts).

While true, it goes against the whole idea of threat modelling to use a one-size-fits-all approach. It doesn't really make sense to use a 128 character password for your GrapheneOS owner profile just because you have a 128-char password for your online accounts. You have to take the context into account, and your input method. I use a passphrase for my owner profile but a PIN on my secondary (main) profile, to name one example.

You can have a good rememberable password you can type yourself plus having that stored in the password manager for those days you might forge

Pretty much what I already do. I store my GOS profile passwords/PINs in my password manager but I also need to remember them, for convenience.