Use the “passwords” feature to check if one of yours is compromised. If it shows up, never ever reuse those credentials. They’ll be baked into thousands of botnets etc. and be forevermore part of automated break-in attempts until one randomly succeeds.
You must log in or # to comment.
Protip for the room: Use a password manager with a unique password for every service. Then when one leaks, it only affects that singular service, not large swaths of your digital life.
Also 2FA. You’ll still want to change passwords but it buys you time.
Also, length is most of what matters. A full length sentence in lowercase with easy to type finger/key flow for pw manager master, and don’t know a single other password. Can someone correct me if I’m wrong?
I’ve found that there are a handful of passwords that you need to remember, the rest can go in the password manager. This includes the password for the password manager, of course, but also passwords for your computer/phone (since you need to log in before you can access the password manager), and your email (to be able to recover your password for the password manager).
You are also correct that length is mostly what matters, but also throwing in a random capitalization, a number or two, and some special character will greatly increase the required search space. Also using uncommon words, or words in other languages than english can also greatly increase the resistance to dictionary attacks.
your email (to be able to recover your password for the password manager)
If your password manager has a password recovery mechanism, that means your key is stored on the server and would be compromised in a breach. If that’s the case, I highly recommend changing password managers.
The ideal way a password manager works is by having all encryption done client-side and never sending the password to the server. If the server cannot decrypt your password data, neither can an attacker. That’s how my password manager works (Bitwarden), and I highly recommend restricting your options only to password managers with that property.
If you need a backup, write it in a notebook and keep it in a safe. If your house gets broken into, change your password immediately before the thief has a chance to rifle through the stuff they stole. My SO and I have shared passwords to all important credentials, so that’s out backup mechanism.
throwing in a special character
Okay, but hackers don’t have to know whether I used special character or just lowercase? Or am I stoopid?
As always, the most secure password is the least convenient and accessible. It’s a trade off, but you want fewer dictionary words and patterns overall. Preferably with a physical component for the master password.
Longer is better…giggitty.
I use a “password pattern”, rather than remembering all the passwords, I just remember a rule I have for how passwords are done, there are some numbers and letters that change depending on what the service is so every password is unique and I can easily remember all of them as long as I remember the rules I put in place
deleted by creator
And when that password manager gets cracked?
Got any examples? Because I have…some…examples of password reuse being a real-life problem.
Yes and no; they have their own issues:
https://cybersecuritynews.com/hackers-weaponize-keepass-password-manager/
Don’t download shit from random websites… make sure its from legit places…
legit places…
My university, 23andMe, Transunion, Equifax, CapitalOne, United Healthcare…
You shouldn’t download KeePass from any of those.
Legit means the keepass website… those are not legit places to download the password manager
Yeah UHC sold my data as soon as I was put under their coverage. Now I get so many phishing emails pretending to be from UHC.
These kinds of breaches are at the site level. Not much you can do as a regular user if the company doesn’t hash or salt their passwords, for example.
I believe they are replying to the article you posted in regards to the download from legit sites comment, not the fact that the sites have shit web practices (which while correct is a different thing).
To the people who didn’t read the article posted in the comment prior, basically the software installed wasn’t the legitimate software, it was a modified software that was a trojan that was forwarding passwords stored in the keepass database to a home server.
That’s not something that the sites are going wrong, nor is it the password managers fault. That’s fully the users fault for downloading a trojan.
Not from what the article says
involves compromised download links and trojanized versions of the legitimate KeePass application that appear identical to the authentic software on the surface, while harboring dangerous capabilities beneath.
Oh, so don’t use unique passwords? Sure buddy.
deleted by creator
Stuffing? Just in time for the holiday season!
moans “stuff me santa”
Santa: “we are skipping that house”
As someone who consults in the IT Security space, It’s bad out there. Contractors and BYOD companies are downright sheepish in asking their outsourced employees to do anything security-related to their devices. The biggest attack vector is allowed unfettered remote access (and therefore the whole company and any bad actors are also granted unfettered remote access)
I still can’t get over how quickly companies-at-large have abandoned VPN Servers (removing network trust from the list of options as well)
I’m down to managed browsers via IdP, and I just can’t wait for the objections to that as well. People out here offering their faces to leopards. Certificate-based MFA on all the things IMO - passwords shouldnt matter (but six digit MFA codes aren’t immune to fake landing pages and siphoned MFA tokens that don’t expire)
I use utterly unique and very long passphrases for the most important stuff (banking, mortgage servicing, email, etc.), 2FA for those and most other things, and just throwaway crap passwords for things I don’t care about (web forums and most everything else).
Let’s make a master list of all the emails leaked with their passwords, what could go wrong?
That’s not how it works
It’s exactly how it worked. A company called synthient made a master list with all the leaked emails + all leaked passwords. Then they were hacked and it leaked
Synthient wasn’t hacked, as a security company, they aggregated tons of stealer logs dumped to social media, Telegram, etc.
They found 8% of the data collected was not in the HIBP database, confirmed with some of the legitimate owners that the data was real.
They then took that research and shared it with HIBP which is the correct thing to do.
I was also thrown off by the title they gave it when I first saw it, a security company being hacked would be a terrible look. but they explain it in the article. Should probably have named it “list aggregation” or something.
so why hibp calls them data breach??? Ultra misleading, almost defamation, everyone including me only reads the headlines
But then nothing has changed if they were just collating what was already leaked.
God fucking dammit, I fucking hate seeing people self-censor themselves on the internet.
This is why my password is hunter2, no one can see what is says under the asterix,
(it’s asterisk)
for anyone who doesn’t get the reference, it’s an ancient Bash chatlog: https://knowyourmeme.com/memes/hunter2
Proud that my only pwned password is three decades old.
Comprised of email addresses and passwords from previous data breaches,
So these are previously “hacked” data, and now the aggregator has been hacked?
Possibly related question. Layely I’ve been getting email ‘replies’ from various businesses and services (all over the country, USA) all about an ‘inquiry’ that I never made. Apparently someone just got my email address and is using that for – what ? A couple questions:
** What is that someone up to, why doing that?
** Should I do something about that?
** What could I do? Don’t want to change email address.
That’s just your email address being sold by information brokers. Not illegal, not a reason to change your email address. Block, delete & move on.
I got this email a few days ago. I don’t even know who these people are and why they have my details. But I’ve had to change my Google account passwords anyway.
Are we supposed to pronounce the two "data"s differently when reading aloud? Asking for a friend…
Apparently my email was included in this breach, but none of the passwords I used with it were (before I started using randomly generated ones).
Is there any info regarding how old this data is?
