We install Debian, Docker, Immich, and even Nextcloud and run a tiny self-hosted virtual Homelab. 0:00 Intro 0:30 Virtual Machine Setup 5:11 First Boot 5:45 SSH Login 6:35 Docker without Sudo 8:06 ...
People who don’t care about security are the cancer of the selfhosting-world. Billions of devices are part of a botnet because lazy/stupid owners don’t care about even the most basic shit, like changing the stock password. It’s insane.
And I kinda don’t want to know if complex passwords and low retries before an account gets locked out are enough.
I’ve created a custom cert that I verify within my nginx proxy using ssl_client_certificate and ssl_verify_client on. I got that cert on every device I use in the browser storage, additionally on a USB stick on my keychain in case I’m on a foreign or new machine. That is so much easier that bothering with passwords and the likes, and it’s infinitely more secure.
Adding certificates is a 5 step process: Settings -> Privacy and Security -> View Certificates -> Import -> Select file and confirm. That’s on firefox at least, idk about chrome, but probably not significantly more complex. With screenshots, a small guide would be fairly easy to follow.
Don’t get me wrong, I do get your point, but I don’t feel like making users add client certs to their browser storage is more work than helping them every 2 weeks because they forgot their password or shit like that lol. At least, that’s my experience. And the cool thing about client certs is they can’t really break it, unlike passwords which they can forget, or change them because they forgot, just to then forget they changed it. Once it runs, it runs.
People who don’t care about security are the cancer of the selfhosting-world. Billions of devices are part of a botnet because lazy/stupid owners don’t care about even the most basic shit, like changing the stock password. It’s insane.
Still feels like I’m doing too little, but kinda hate 2fa.
And I kinda don’t want to know if complex passwords and low retries before an account gets locked out are enough.
I’ve created a custom cert that I verify within my nginx proxy using
ssl_client_certificateandssl_verify_client on. I got that cert on every device I use in the browser storage, additionally on a USB stick on my keychain in case I’m on a foreign or new machine. That is so much easier that bothering with passwords and the likes, and it’s infinitely more secure.That would only work if I’m the only one using my hosted stuff, but can’t really expect non tech ppl to deal with stuff like that.
They already struggle with the little 2fa they have to use. Introducing yet another system is too much to ask.
Adding certificates is a 5 step process: Settings -> Privacy and Security -> View Certificates -> Import -> Select file and confirm. That’s on firefox at least, idk about chrome, but probably not significantly more complex. With screenshots, a small guide would be fairly easy to follow.
Don’t get me wrong, I do get your point, but I don’t feel like making users add client certs to their browser storage is more work than helping them every 2 weeks because they forgot their password or shit like that lol. At least, that’s my experience. And the cool thing about client certs is they can’t really break it, unlike passwords which they can forget, or change them because they forgot, just to then forget they changed it. Once it runs, it runs.