[deleted] t1_j1nj17v wrote
Dinos_12345 t1_j1nkd9k wrote
Also, password manager. I couldn't tell you any of my passwords if held at gunpoint, I couldn't even give you access to 1password because it also needs the security key which I don't remember by heart either.
RandyDandyHoe t1_j1npkgc wrote
I try to use pass phrases that I can remember for the most important accounts, like my main email, bank account, etc. But otherwise yeah it's just a bunch of random letters, signs and numbers with as many characters as I'm allowed to use, and there's no way I'd ever get onto any of those accounts without Bitwarden.
nsa_reddit_monitor t1_j1o4ln6 wrote
I use Keepass, it has a standard format for password databases so a lot of tools and apps exist to read a Keepass database. I make sure (via various methods) that all my computers and phones and backups have a copy of my password database.
I only have the Keepass password memorized, and a couple of my computers use that password for their full-disk encryption (because if you get past that, I'm screwed regardless of if you have my passwords). Basically, unless you take down my computers, my phones, and a couple backups in undisclosed locations, I won't lose any of my passwords.
So I don't even know my bank or email login. Worst case, I can just go to the bank and have them reset it in person. And my email is hosted on a private server I own (in an undisclosed location), so I could physically go to the datacenter and plug a keyboard in to regain access.
TB_Batman t1_j1pc9d7 wrote
Mine are based on my favorite Runescape quests combined with a number and special letter :3
Low_Requirement3266 t1_j1pdd0a wrote
based
Robobvious t1_j1pix82 wrote
All my passwords are the titles of romcoms.
krkrkrkk24 t1_j1o5mi3 wrote
Password manager đ Lastpass literally got hacked a few days ago releasing into the wild users' passwords vaults only encrypted with the master password which can easily be brute forced if weak as well as unencrypted URLs the specific user has visited, just write all your passwords down.
sy029 t1_j1o9qkn wrote
I switched to keepass years ago after the first lastpass hack. It's completely offline.
anonynown t1_j1pbz0d wrote
> which can easily be brute forced if weak
That isnât how password managers typically work. Your password vault is encrypted with a much longer key stored on your device. The master key is only used to decrypt the actual decryption key which is long and isnât stored on their servers, and the master key is useless otherwise. This is why you need to approve on your existing device when enrolling a new one, or enter a very long ârecoveryâ key â thatâs how the actual decryption key gets to the new device. Even knowing your master password doesnât enable the attacker to access your vault without extra steps, like using social engineering to get you to reveal your recovery key or approve a new login.
Plokmijn27 t1_j1o905q wrote
for real
ive honestly been waiting for this to happen
cant believe people think password managers are a good idea
either use the same password for everything like a normal person, or write them down in a notebook, or on a file on your PC
the chances of lastpass or whatever other company getting hacked is a million times more likely than hackers breaking into your house and stealing your notebook
sy029 t1_j1o9u2z wrote
Or just use an offline password manager.
flyingroad t1_j1or66z wrote
And also using the same password for everything is dumb.
If one of your accounts get compromised, most likely your other accounts will get compromised.
redyellowblue5031 t1_j1oyuw1 wrote
Exactly. Criminals love people who do this, they even have an attack named after it; credential stuffing.
redyellowblue5031 t1_j1oyrrm wrote
Using the same password everywhere is a fun game if you like credential stuffing.
No system is 100% safe, but if youâre not using a weak master password and also have MFA enabled even with a stolen vault your passwords are safe by all reasonable measures.
krkrkrkk24 t1_j1o9ai9 wrote
Yeah, seriously just the though of password managers putting all user information in a server together is more than enough to be targeted by hackers and its crazy people think its a good idea to just hand your passwords to 3rd party vendors that will claim no responsibility in case of such event
redyellowblue5031 t1_j1oz61j wrote
Managing access is largely about risk vs convenience.
Every major password manager has a plethora of options to mitigate any reasonable risk even if someone got a hold of your vault.
The only way theyâre getting in is if you used a weak password to begin with.
SpaceArf t1_j1p6zgc wrote
I really should get my self hosted bitwarden set up on my pi. Just really lazy to do it.
degovial t1_j1o75pq wrote
These "hacking" attempts don't come from brute force, but come from database leaks, most of the times... or social engineering. Creating strong passwords helps against brute force technics and decrypting encrypted databases that were leaked.
Big or small, no one gives a fuck... just use 2FA and sleep better at night lol.
Izzetmaster01 t1_j1noxcz wrote
I had the most random strong password that would be unguessable. Didn't matter. Still got log in attempts. It really doesn't seem to matter dude
Shuski_Cross t1_j1np3x0 wrote
hunter2 is not a strong password...
Izzetmaster01 t1_j1nqwqo wrote
Funny guy you. We're talking literal hf_2J8@f etc. As strong as you can get as it was about 15 characters and purely random
Shuski_Cross t1_j1nz55l wrote
At his point, it seems you have a key logger installed on your pc.
Izzetmaster01 t1_j1nzmo9 wrote
You realise that most people on the internet aren't technologically illiterate. I don't have a key logger. Otherwise I would be complaining about all of my accounts. It just doesn't matter for steam for whatever reason. You're just coming to a really silly assumption
Grievuuz t1_j1o31xs wrote
I don't wanna butt into the conversation, but I do feel the need to correct you.
The internet currently has 4.9 billion users.
Absolutely no fucking chance that more than half of them even know what a keylogger is.
None.
[deleted] t1_j1o3hdd wrote
[removed]
mortenmhp t1_j1ogoni wrote
Sorry to break it to you. If you are getting log in attempts on Steam with 2fa, someone has your password. Either you got phished, your password was reused and leaked from somewhere or you have a keylogger.
Izzetmaster01 t1_j1oh3mi wrote
I don't know how many times I've got to say it. Seeing as though it was the most random password going and wasn't reused. The only plausible thing would be steam leak. But again doesn't even matter with 2FA. I also don't know how obvious I have to make it, before anyone else comments on having a keylogger, that I don't have a keylogger. Because once again, I've only ever had this issue with steam
brusiddit t1_j1p0zo0 wrote
There are 2FA phishing kits around now that make it really easy to phish peoples 2fa codes. The power of MFA is redundancy.
If one of the engines on your plane dies, the first thing you do is go repair the engine, not fly around on only one.
The most important thing i know about infosec is that everything is hackable and no-one is immune to social engineering.
mortenmhp t1_j1w4pzk wrote
Beautiful analogy
Shuski_Cross t1_j1o7egc wrote
I work in IT, surrounded by people who are "technologically literate" and IT "professionals", and I can tell you, 80% struggle to use their laptop docks, and struggle to change the meeting TVs to HDM1. People are reaaaaaallly dumb.
Think of how dumb you think they are, then septuple it. You just catalogued half of the people....
Keyloggers are the simplist, and easiest "viruses" and easily undetectable for 99.9% of IT population.
Edit: That wasn't me calling you dumb, I'm genuinely worried for your account, you shouldn't be getting 2FA for it with a gibberish 15 character password.
complicados t1_j1oxxrl wrote
I have super easy passwords on some of my gmail and other not that important accounts and donât get login attempts, and yes Iâd know because whenever I login to them on my own devices I get notified and need confirmation. You definitely have a key logger⌠time for malwarebytes or switch to a mac if windows is that difficult to keep secure for you
ZsaFreigh t1_j1p5z8v wrote
Yeah if your email has been "pwned" in a data breach (see haveibeenpwned.com) you'll never stop getting log in attempts from people credential stuffing your email address wherever they can. Which is why you should use different, strong passwords for every site you use, and an extra strong one for your email.
RandyDandyHoe t1_j1nprn1 wrote
Some platforms send log in attempts if the password is wrong, pretty sure. If you have a simple username then that might be the issue
Izzetmaster01 t1_j1nqxmg wrote
Steam doesn't do that....
EveryChair8571 t1_j1nt6li wrote
During lockdown the attempts on my accounts everywhere for everything were bananas
hecking-doggo t1_j1nz0bz wrote
My password is pretty iffy and I've had no attempts to hack my steam. Probably cuz I don't have much that hackers would want
Plokmijn27 t1_j1o98bp wrote
password strength has nothing to do with login attempts
login attempts are tracked regardless of whether or not someone put in the correct password
Viewing a single comment thread. View all comments