this post was submitted on 17 Jan 2024
5 points (72.7% liked)
cybersecurity
3262 readers
1 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
That's still gaining access through a device that's already signed in/has your password db.
If you do not have access to a device that's already signed into your accounts/has a copy of your password db; how do get in?
Presumably you're smart enough to not have password only auth on a public facing nextcloud instance if it stores your password db...
This is the scenario we are discussing. The fact you store you db on other devices is entirely irrelevant.
My nextcloud instance uses fail2ban and I use a >32bit strong password.
Assuming I lose my phone and my laptop and my personal computer and my nextcloud instance I would be screwed.
Since I host my own mailserver I would be able to create a new mailserver with a new password though and recover any accounts with a new email.