Hector Martin

The Chief Product Officer at Yubico thinks "long passwords" offer little security. 2ee75ee4e4b359576257fc7d3bfc5ec75d358f10e17caf9e668e09cc032af36d That is the SHA256 of the 76-character passphrase to my master backups, plus '!'. Pwn me. I'm waiting.https://twitter.com/appenz/status/1238121735142031360 …

76 characters? You have me beat. Most of my root passwords are UUIDs or derived from them - I figure 124 bits of /dev/urandom is enough.

Of course, since I also have SSH password login disabled, even cracking it won't do you any good unless you have local console or an SSH client certificate session to "su" from...

Ah, but you see, on my most sensitive machine I use *both* key *and* password login (yes, you can do that with SSH). :-)

I already have some level of MFA: if you are not physically on the wired lab network (wifi is firewalled off) you can't even touch the SSH port on any of my machines without *also* being VPN'd in.

Ah, I tend not to totally rely on network security except for really dumb devices (*cough* IoT *cough*), so my home stuff all has public IPv6 addresses and you can SSH in from anywhere. The subset of really sensitive traffic currently on my home network uses IPsec.

I prefer defense-in-depth. I have a rather complex network segmentation at home with about a dozen different subnets because I have so much SCADA/test equipment (e.g. oscilloscopes with plaintext SCPI interfaces) that doesn't support anything else.

But I also don't trust the Chinese IP cams not to phone home, and I want my wife's laptop or our game consoles to have no access to any of that... the list goes on. The VPN also allows IPv4 access to non-ipv6-supporting gear from the outside w/o port forwards.