• 1 Post
  • 35 Comments
Joined 1 year ago
cake
Cake day: June 8th, 2023

help-circle






  • Not a security scientist, but in my interpretation, it’s the “categories” of the factors that matter. Ideally, you use some two of three of:

    • something (only) you know - generally represented by passwords
    • something (only) you have - most commonly represented by some device. you prove that you have the device by providing a token only that device can generate.
    • something (only) you are - generally represented by biometrics

    the goal then is maintaining the "only"s.

    if you tell someone your password, or they see you type it in, or they beat it out of you with a wrench, it’s no longer something “only” you know, and it is compromised.

    if you use the same password on two websites, and one website is compromised, the password is compromised.

    OTPs from a key fob or yubikey or something are similarly compromised if the device that provides them is left out in public/lost/stolen/beaten out of you with a wrench.

    biometrics are again, are compromised if it’s not “only” you with access to them - someone scans you face while you’re asleep, or smashes your finger off with their wrench.

    having multiple factors in the same category, like having two passwords, or two otp tokens, or two finger prints, doesn’t significantly improve security. if you give up one thing you remember, it’s likely you’ll give up more. if one fob from your keychain is stolen, the second fob on that keychain is of no additional help.

    you can start shifting what categories these things represent though.

    if you write down your password in a notebook or a spreadsheet, they become thing you have.

    OTPs can become something you know if you remember the secret used to generate them.

    knowing many different things is hard, so you can put them in a password vault. the password vault is then something you have, which can be protected by something you know. so although your OTPs and passwords are in one place, you still require two factors to get access to them.

    you still need to protect your "only"s though. and don’t put yourself in situations where people with wrenches want your secrets.














  • just to add a little more explanation to what the other posters are suggesting… a hard drive, from the perspective of your OS is very very simple. it’s a series of bytes. for the sake of this example, let’s say there are 1000 of them. they are just a series of numbers.

    how do you tell apart which numbers belong to which partitions? well there’s a convention: you decide that the first 10 of those numbers can be a label to indicate where partions start. e.g. your efi starts at #11 and ends at #61. root at starts at #61 and ends at #800. the label doesn’t say anything about the bytes after that.

    how do you know which bytes in the partions make up files? similar sort of game with a file system within the bounds of that partion - you use some of the data as a label to find the file data. maybe bytes 71-78 indicate that you can find ~/.bash_histor at bytes 732-790.

    what happened when you shrunk that root partions, is you changed that label at the beginning. your root partion, it says, now starts at byte #61 and goes to #300. any bytes after that, are fair game for a new partion and filesystem to overwrite.

    the point of all this, is that so far all you’ve done is changed some labels. the bytes that make up your files are still on the disk, but perhaps not findable. however - because every process that writes to the disk will trust those labels, any operation you do to the disk, including mounting it has a chance to overwrite the data that makes up your files.

    this means:

    • most of your files are probably recoverable
    • do not boot the operating system on that drive, or any other that will attempt to mount it, because you risk overwring data
    • before you start using any data recovery tools, make a copy of the raw bytes of the disk to a different disk, so that if the tools mess up you have an option to try again

    ONLY after that is done, the first thing I’d try is setting that partion label back to what it used to say, 100gb… if you’re lucky, everything will just work. if you aren’t, tools like ‘photorec’ can crawl the raw bytes of the disk and try and output whatever files they find.

    good luck!