There is indeed a whole lot of problems with security and we don’t have consensus on a nice/minimum setup. My main concern right now is the physical access to hardware (my place is far from being a vault). Finding my address would not be that big of an issue then getting in would be very easy.

For now having backups in multiple places is the best for me, having physical keys is not solving any on my security concern. The good part is no one cares about my stuff so for now this is OK.

If you have any concern I would gladly hear technical insight about the threat model involved. The cross-post on the Privacy communities sparked more conversation if you want to follow up on that point : https://lemmy.ml/post/12744864.

Extension “authenticator” has been around for more than a decade now. I am sharing something that is small, simple, auditable and secure (no permission to do anything but past on clipboard).

Next part is going to be security and some storage off-loading on memory (mostly avoiding logs on storage). Then probably a part 3 on server stack (nginx/apache) and network.

I never encounter this CG/NAT, I’m wondering how it goes with online game for instance (wouldn’t it be a no-go for many casual users?). I have set-up once a VPN as a reverse-proxy, buying the lowest tiers of VPS (Virtual Private Server) as it would had a public IP to use and just forward everything to the server (which was in a shared space so kind of the same as CG/NAT). This is not 100% host but at least the VPS is just a gateway and doesn’t hold anything and is easily replaceable.