Viewing a single comment thread. View all comments

DigitalSteven1 t1_j1mujoj wrote

Reply to comment by Snagmesomeweaves in LPT: Got a Steam gift card for Christmas? Hold on to it after you put the code in. If your account gets hacked, you can use the old code to recover your account. by Worst_Support

Honestly, it doesn't matter how shitty your password is, or if it's been leaked if you have 2fa on. I've gotten probably no less than 40 attempts to log into my account sent to my phone, all of them with the right password, but none of them can get in. Should I change it? Yeah. Am I going to? Probably not.

​

Fun fact, when steam rolled out 2FA, Gabe Newell publicly released his account's username and password. No one ever got into it. He has changed it since then, though.

111

[deleted] t1_j1nj17v wrote

[deleted]

59

Dinos_12345 t1_j1nkd9k wrote

Also, password manager. I couldn't tell you any of my passwords if held at gunpoint, I couldn't even give you access to 1password because it also needs the security key which I don't remember by heart either.

37

RandyDandyHoe t1_j1npkgc wrote

I try to use pass phrases that I can remember for the most important accounts, like my main email, bank account, etc. But otherwise yeah it's just a bunch of random letters, signs and numbers with as many characters as I'm allowed to use, and there's no way I'd ever get onto any of those accounts without Bitwarden.

7

nsa_reddit_monitor t1_j1o4ln6 wrote

I use Keepass, it has a standard format for password databases so a lot of tools and apps exist to read a Keepass database. I make sure (via various methods) that all my computers and phones and backups have a copy of my password database.

I only have the Keepass password memorized, and a couple of my computers use that password for their full-disk encryption (because if you get past that, I'm screwed regardless of if you have my passwords). Basically, unless you take down my computers, my phones, and a couple backups in undisclosed locations, I won't lose any of my passwords.

So I don't even know my bank or email login. Worst case, I can just go to the bank and have them reset it in person. And my email is hosted on a private server I own (in an undisclosed location), so I could physically go to the datacenter and plug a keyboard in to regain access.

3

Robobvious t1_j1pix82 wrote

All my passwords are the titles of romcoms.

1

krkrkrkk24 t1_j1o5mi3 wrote

Password manager 😁 Lastpass literally got hacked a few days ago releasing into the wild users' passwords vaults only encrypted with the master password which can easily be brute forced if weak as well as unencrypted URLs the specific user has visited, just write all your passwords down.

5

sy029 t1_j1o9qkn wrote

I switched to keepass years ago after the first lastpass hack. It's completely offline.

3

anonynown t1_j1pbz0d wrote

> which can easily be brute forced if weak

That isn’t how password managers typically work. Your password vault is encrypted with a much longer key stored on your device. The master key is only used to decrypt the actual decryption key which is long and isn’t stored on their servers, and the master key is useless otherwise. This is why you need to approve on your existing device when enrolling a new one, or enter a very long “recovery” key — that’s how the actual decryption key gets to the new device. Even knowing your master password doesn’t enable the attacker to access your vault without extra steps, like using social engineering to get you to reveal your recovery key or approve a new login.

1

Plokmijn27 t1_j1o905q wrote

for real

ive honestly been waiting for this to happen

cant believe people think password managers are a good idea

either use the same password for everything like a normal person, or write them down in a notebook, or on a file on your PC

the chances of lastpass or whatever other company getting hacked is a million times more likely than hackers breaking into your house and stealing your notebook

−9

sy029 t1_j1o9u2z wrote

Or just use an offline password manager.

8

flyingroad t1_j1or66z wrote

And also using the same password for everything is dumb.

If one of your accounts get compromised, most likely your other accounts will get compromised.

4

redyellowblue5031 t1_j1oyuw1 wrote

Exactly. Criminals love people who do this, they even have an attack named after it; credential stuffing.

2

redyellowblue5031 t1_j1oyrrm wrote

Using the same password everywhere is a fun game if you like credential stuffing.

No system is 100% safe, but if you’re not using a weak master password and also have MFA enabled even with a stolen vault your passwords are safe by all reasonable measures.

3

krkrkrkk24 t1_j1o9ai9 wrote

Yeah, seriously just the though of password managers putting all user information in a server together is more than enough to be targeted by hackers and its crazy people think its a good idea to just hand your passwords to 3rd party vendors that will claim no responsibility in case of such event

1

redyellowblue5031 t1_j1oz61j wrote

Managing access is largely about risk vs convenience.

Every major password manager has a plethora of options to mitigate any reasonable risk even if someone got a hold of your vault.

The only way they’re getting in is if you used a weak password to begin with.

2

SpaceArf t1_j1p6zgc wrote

I really should get my self hosted bitwarden set up on my pi. Just really lazy to do it.

2

degovial t1_j1o75pq wrote

These "hacking" attempts don't come from brute force, but come from database leaks, most of the times... or social engineering. Creating strong passwords helps against brute force technics and decrypting encrypted databases that were leaked.

Big or small, no one gives a fuck... just use 2FA and sleep better at night lol.

5

Izzetmaster01 t1_j1noxcz wrote

I had the most random strong password that would be unguessable. Didn't matter. Still got log in attempts. It really doesn't seem to matter dude

1

Shuski_Cross t1_j1np3x0 wrote

hunter2 is not a strong password...

7

Izzetmaster01 t1_j1nqwqo wrote

Funny guy you. We're talking literal hf_2J8@f etc. As strong as you can get as it was about 15 characters and purely random

1

Shuski_Cross t1_j1nz55l wrote

At his point, it seems you have a key logger installed on your pc.

8

Izzetmaster01 t1_j1nzmo9 wrote

You realise that most people on the internet aren't technologically illiterate. I don't have a key logger. Otherwise I would be complaining about all of my accounts. It just doesn't matter for steam for whatever reason. You're just coming to a really silly assumption

−10

Grievuuz t1_j1o31xs wrote

I don't wanna butt into the conversation, but I do feel the need to correct you.

The internet currently has 4.9 billion users.

Absolutely no fucking chance that more than half of them even know what a keylogger is.

None.

12

mortenmhp t1_j1ogoni wrote

Sorry to break it to you. If you are getting log in attempts on Steam with 2fa, someone has your password. Either you got phished, your password was reused and leaked from somewhere or you have a keylogger.

8

Izzetmaster01 t1_j1oh3mi wrote

I don't know how many times I've got to say it. Seeing as though it was the most random password going and wasn't reused. The only plausible thing would be steam leak. But again doesn't even matter with 2FA. I also don't know how obvious I have to make it, before anyone else comments on having a keylogger, that I don't have a keylogger. Because once again, I've only ever had this issue with steam

−5

brusiddit t1_j1p0zo0 wrote

There are 2FA phishing kits around now that make it really easy to phish peoples 2fa codes. The power of MFA is redundancy.

If one of the engines on your plane dies, the first thing you do is go repair the engine, not fly around on only one.

The most important thing i know about infosec is that everything is hackable and no-one is immune to social engineering.

6

Shuski_Cross t1_j1o7egc wrote

I work in IT, surrounded by people who are "technologically literate" and IT "professionals", and I can tell you, 80% struggle to use their laptop docks, and struggle to change the meeting TVs to HDM1. People are reaaaaaallly dumb.

Think of how dumb you think they are, then septuple it. You just catalogued half of the people....

Keyloggers are the simplist, and easiest "viruses" and easily undetectable for 99.9% of IT population.

Edit: That wasn't me calling you dumb, I'm genuinely worried for your account, you shouldn't be getting 2FA for it with a gibberish 15 character password.

5

complicados t1_j1oxxrl wrote

I have super easy passwords on some of my gmail and other not that important accounts and don’t get login attempts, and yes I’d know because whenever I login to them on my own devices I get notified and need confirmation. You definitely have a key logger… time for malwarebytes or switch to a mac if windows is that difficult to keep secure for you

3

ZsaFreigh t1_j1p5z8v wrote

Yeah if your email has been "pwned" in a data breach (see haveibeenpwned.com) you'll never stop getting log in attempts from people credential stuffing your email address wherever they can. Which is why you should use different, strong passwords for every site you use, and an extra strong one for your email.

3

RandyDandyHoe t1_j1nprn1 wrote

Some platforms send log in attempts if the password is wrong, pretty sure. If you have a simple username then that might be the issue

1

EveryChair8571 t1_j1nt6li wrote

During lockdown the attempts on my accounts everywhere for everything were bananas

1

hecking-doggo t1_j1nz0bz wrote

My password is pretty iffy and I've had no attempts to hack my steam. Probably cuz I don't have much that hackers would want

1

Plokmijn27 t1_j1o98bp wrote

password strength has nothing to do with login attempts

login attempts are tracked regardless of whether or not someone put in the correct password

0

sy029 t1_j1o9mim wrote

I don't know if steam has a problem with it, but your biggest enemy is actually the employees themselves.

There's plenty of stories where someone got enough personal info to just call support for some website, reset the password, and be handed the keys.

2

jacobFunkhouser t1_j1oac53 wrote

There are ways to get your 2fa especially if it goes to your phone number. Probably won’t happen to a steam account but people have been known to figure out ways to sim swap or trick people into sending the code.

2

ContemplatingPrison t1_j1ogla7 wrote

Happens with my Venmo. I finally decided to change my password. But for days I was getting attempts to log in.

Which is fine I always delete my bank account and or card info when I am done using those types of account. I rarely use them.

I hate having my cards or account attached to a bunch of apps or services.

1