krkrkrkk24 t1_j1o5mi3 wrote
Reply to comment by Dinos_12345 in LPT: Got a Steam gift card for Christmas? Hold on to it after you put the code in. If your account gets hacked, you can use the old code to recover your account. by Worst_Support
Password manager đ Lastpass literally got hacked a few days ago releasing into the wild users' passwords vaults only encrypted with the master password which can easily be brute forced if weak as well as unencrypted URLs the specific user has visited, just write all your passwords down.
sy029 t1_j1o9qkn wrote
I switched to keepass years ago after the first lastpass hack. It's completely offline.
anonynown t1_j1pbz0d wrote
> which can easily be brute forced if weak
That isnât how password managers typically work. Your password vault is encrypted with a much longer key stored on your device. The master key is only used to decrypt the actual decryption key which is long and isnât stored on their servers, and the master key is useless otherwise. This is why you need to approve on your existing device when enrolling a new one, or enter a very long ârecoveryâ key â thatâs how the actual decryption key gets to the new device. Even knowing your master password doesnât enable the attacker to access your vault without extra steps, like using social engineering to get you to reveal your recovery key or approve a new login.
Plokmijn27 t1_j1o905q wrote
for real
ive honestly been waiting for this to happen
cant believe people think password managers are a good idea
either use the same password for everything like a normal person, or write them down in a notebook, or on a file on your PC
the chances of lastpass or whatever other company getting hacked is a million times more likely than hackers breaking into your house and stealing your notebook
sy029 t1_j1o9u2z wrote
Or just use an offline password manager.
flyingroad t1_j1or66z wrote
And also using the same password for everything is dumb.
If one of your accounts get compromised, most likely your other accounts will get compromised.
redyellowblue5031 t1_j1oyuw1 wrote
Exactly. Criminals love people who do this, they even have an attack named after it; credential stuffing.
redyellowblue5031 t1_j1oyrrm wrote
Using the same password everywhere is a fun game if you like credential stuffing.
No system is 100% safe, but if youâre not using a weak master password and also have MFA enabled even with a stolen vault your passwords are safe by all reasonable measures.
krkrkrkk24 t1_j1o9ai9 wrote
Yeah, seriously just the though of password managers putting all user information in a server together is more than enough to be targeted by hackers and its crazy people think its a good idea to just hand your passwords to 3rd party vendors that will claim no responsibility in case of such event
redyellowblue5031 t1_j1oz61j wrote
Managing access is largely about risk vs convenience.
Every major password manager has a plethora of options to mitigate any reasonable risk even if someone got a hold of your vault.
The only way theyâre getting in is if you used a weak password to begin with.
Viewing a single comment thread. View all comments