# Triple Sec Triple Sec is a personal security setup written up by [Alexander Nemish](https://github.com/nau) in January 2023. He calls it a "KISS security setup scheme" (see [[Keep It Simple Stupid (KISS)]]) for your MacBook, iPhone and web services, and the goal is modest on purpose: easy to use, "relatively hard to break". There's nothing to install. Triple Sec is a long guide (a web page and a PDF) telling you which secrets to create, where to put each of them, and what to do when things go wrong. The problem it tackles is one I recognize: most security advice gives you a pile of rules but no complete system. Which secrets do you memorize, and which go into the password manager? How do you get back in if your house burns down with every device inside? And who gets access when you die? Triple Sec answers all of these with a single design, built around one constraint: memorize as little as possible. The page opens with AviD's Rule of Usability: "Security at the expense of usability comes at the expense of security" (more on that in [[Usability]] and [[Opt for simpler security controls over complex ones]]). ## How it works Everything starts from two things you keep in your head: - **A random 6-digit PIN.** It's your iPhone passcode, and its first 4 digits become your SIM PIN (against SIM swapping) - **Three random words** from EFF Dice or Diceware Insert the PIN somewhere among the three words and you get your Bitwarden master password (e.g., `cake984073ropingvocation`). One of the words plus the PIN gives you your laptop password. Bitwarden then generates and stores every other password, along with the TOTP 2FA codes and recovery codes. Day to day, TouchID and FaceID stand in for all of it, so you rarely type any of it. The author does the math. The PIN is ~20 bits of entropy, the three words ~39 bits, and the PIN's position adds 2 more. That's roughly 60 bits. With 100,000 PBKDF2-SHA256 iterations and an attacker computing a billion hashes per second, he estimates about 1.8 million years to brute-force the master password. He also explains why he picked Bitwarden: open source, cross-platform, free, audited, with built-in emergency access. 1Password works with the same rules. Apple Keychain doesn't work with Firefox, KeePassXC doesn't run on iPhones, and LastPass is a flat "avoid" (the guide links to its December 2022 breach notice). There are two extra layers on top of the password manager: - **Really Important Info** (crypto seeds, PGP keys, passwords you don't want in Bitwarden) goes into a VeraCrypt volume synced to Google Drive or iCloud. The volume has a hidden part with its own password, which gives you plausible deniability if someone forces you to open it. [[Cryptomator]] plays a similar role (encrypted vaults inside a cloud drive) but without the hidden volume. For the crypto itself, he recommends a hardware wallet (Ledger, Trezor or Jade), which connects to [[Cryptocurrencies]] - **Disaster recovery and legacy.** You write your master password, PIN, backup codes and other secrets into a `Readme-<version>.txt` file. Then you derive a key from your master password with PBKDF2 (the page has a small in-browser calculator), encrypt the file with `gpg -c --cipher-algo AES256` (see [[How to install and configure GPG (Article)]]), send it over Signal to a few trusted people, and delete the local copies. The derived key goes into your [[Google]] Digital Legacy plan. When you die, your people get the key from Google and decrypt the file. Lose everything, and you only need your passphrase: recompute the key and ask them for the file. Stop trusting one of them? Bump the version, which changes the derived key, re-encrypt, and share the new file The second half of the guide is a threat catalog, and that's the part I find the most useful: a stolen laptop with or without its password, a stolen iPhone, a ban from Google, a copied SIM card, a rooted laptop, social engineering, a spouse turning malevolent, and "thermorectal cryptanalysis" (his answer to that one: "You are screwed."). Every scenario says what the attacker gets and what you do next, and there are concrete checklists for a lost laptop and a lost iPhone. The assumptions are listed upfront too: you aren't the target of a state-level attack, your significant other isn't "an evil psychopath", and your devices aren't compromised at setup time. ## What I think I like the shape of it a lot. Most people never think about recovery or legacy at all, and this guide forces you to: write down what you depend on, decide who can get it back for you, and make sure revoking someone is cheap. The threat table is a good template for a personal threat model, whatever tools you end up using. The weak spot is the shared PIN. The same six digits are your phone passcode, half your laptop password and a third of your master password. A phone PIN is easy to shoulder-surf. And anyone who learns your laptop password also gets the PIN plus one of the three words, which leaves very little entropy protecting the vault. The author doesn't hide it; his "Cons" list says you are screwed if someone records your Bitwarden password or knows your device passwords, and that your partner could get in "if they know what they are doing". Still, I'd pick independent secrets for the laptop and the vault. The cost is a few more characters to memorize. Also keep in mind that it's dated. The page was last updated in January 2023 and is tied to Intel MacBooks with the T2 chip and iPhone 7 or later. The 100,000-iteration figure was Bitwarden's PBKDF2 default at the time; Bitwarden's default is now 600,000 iterations, with Argon2id as an option, so the brute-force estimate only gets better. The repository has no license file, and it holds the AsciiDoc sources, the PDF and an early TLA+ model of the attacks (`SecSpec.tla`) that still references LastPass and Authy. It got almost no traction on Hacker News (three submissions, a handful of points). I use [[Proton Pass]] rather than Bitwarden. The scheme doesn't depend on the password manager, though; the ideas carry over as long as yours opens with TouchID/FaceID and stores TOTP codes. Not to be confused with Keybase's TripleSec, an encryption library with the same name. ## References - Triple Sec guide: https://nau.github.io/triplesec - Source repository: https://github.com/nau/triplesec - PDF version: https://github.com/nau/triplesec/raw/master/TripleSec.pdf - Author's GitHub profile: https://github.com/nau - Bitwarden KDF algorithms (current defaults): https://bitwarden.com/help/kdf-algorithms/ - Hacker News submission (January 2023): https://news.ycombinator.com/item?id=34368031 ## Related - [[Data Security]] - [[IT Security (MoC)]] - [[Keep It Simple Stupid (KISS)]] - [[Opt for simpler security controls over complex ones]] - [[Proton Pass]] - [[Cryptomator]] - [[2FAS]]