Use the "passwords" feature to check if one of yours is compromised. If it shows up, never ever reuse those credentials. They'll be baked into thousands of botnets etc. and be forevermore part of automated break-in attempts until one randomly succeeds.

you are viewing a single comment's thread
view the rest of the comments
[–] 329 points 1 year ago (93 children)

Protip for the room: Use a password manager with a unique password for every service. Then when one leaks, it only affects that singular service, not large swaths of your digital life.

  • source
  • hideshow 93 child comments
  • [–] 96 points 1 year ago (7 children)
  • [–] 41 points 1 year ago (4 children)

    I hate how many places don't allow for + aliases. I want to know who leaked my email.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 20 points 1 year ago (1 child)

    At the same time, it is trivially easy to strip a + alias, so I'd not trust it to do anything much at all.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 7 points 1 year ago

    If you use aliases for all services, it makes it slightly harder to automate trying one leaked email on another site, since the hacker needs to add the new alias on the other service.

    No one is going through of all these credentials manually, so any extra obscurity can actually bring you security in a pinch. Although if you have different passwords this shouldn't matter much...

  • source
  • parent
  • [–] 20 points 1 year ago* (last edited 1 year ago)

    No + required. There are hundreds of companies offering aliases using their shared domain. You can also just generate a temporary email address if you don't require any ongoing communication and the account is not super important.

  • source
  • parent
  • [–] 55 points 1 year ago (4 children)

    Don't forget unique email addresses. I've had two spam emails in the last 6 months, I could trace them to exactly which company I gave that email address to (one data breach, one I'm pretty sure was the company selling my data). I can block those addresses and move on with my life.

    My old email address from before I started doing this still receives 10+ spam emails a day.

  • source
  • parent
  • hideshow 4 child comments
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [–] 36 points 1 year ago (2 children)

    This trick is common enough and trivial to reverse engineer. I can just purge my billion-email-address hacked list of all characters between a + and an @ and have a clean list that untraceable with your system.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 12 points 1 year ago (1 child)

    Right? Has this ever worked for anyone? I've never bothered because of how easy it is for spammers to bypass.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 17 points 1 year ago*

    Spammers go for the easiest targets. If you do stuff like this, they might redesign their system to make it LESS likely to send to you. Keep in mind theyre targetting the elederly, mentally handicapped, and the emotionally desperate. They specifically DO NOT want to target the educated, technologically literate, and those that will waste their time. By attempting to technologically limit them from their scams, you make it more difficult for them to target you and it makes it obvious theyre not worth your time.

    Its not about making yourself scam proof, its about making yourself an unappealing target.

    (This all applies to scam emails, dunno if it has any effect if the goal is phishing but i would imagine so. If they can phish 5 people in the time it takes to phish you, youre no longer their target.)

    Edit: this is why scam emails look obviously scammy, with misspelled words and grammarical errors. Its not a mistake, its an attempt to preemptively weed out people who want to waste their time

  • source
  • parent
  • load more comments (1 reply)
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [–] 55 points 1 year ago (8 children)

    Bitwarden has been good for me, but I actually don't know about safari...

  • source
  • parent
  • hideshow 8 child comments
  • [–] 23 points 1 year ago (7 children)

    It works with Safari. I use both Bitwarden and mobile/desktop Safari.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 8 points 1 year ago (6 children)

    Thank you for actually answering the question.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 5 points 1 year ago (5 children)

    On mobile, Bitwarden is an app that fills login/password info into your browser.

  • source
  • parent
  • hideshow 5 child comments
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • load more comments (1 reply)
  • [–] 11 points 1 year ago

    Keepass does a pretty decent job. I have keepassXC on my Windows, Debian and Android devices. On Android it's integrated into the phone(and the autofill service if actual 2fa isn't supported on the app) so it works on every application. With IOS though I know they can be a stickler on anything remotely technical so I'm not sure if something similar exists with it. I also use syncthing as the service to make sure the same copy of the database is on each device to prevent having to use a password manager that requires a subscription for a cloud service, this also minimizes my risk factor of a cloud service being compromised.

  • source
  • parent
  • [–] 6 points 1 year ago (2 children)

    For mobile safari Bitwarden (and I think a number of others, but Bitwarden's the only one I can speak to) ties into Apple's password management system for autofill and password generation. Still have to use the app or webpage (either Bitwarden's official site or self-hosted vaultwarden) for more in depth management.

    For mobile Firefox, on iOS it's the same as Safari. On Android you can either use the Bitwarden add-on or use it with the app and Android's built-in password management system just like on iOS.

    Since you mentioned "all browsers" for chrome/chromium based browsers there is also on add-on for both mobile and desktop. For Internet Explorer and pre-chrome Edge I don't believe there's an add-on but it can still work, it'll just be more of a pain since you autofill either won't work or will be spotty. You'll probably be relying on the standalone desktop app.

    On MacOS it integrates with Apple's password management, so no need for an add-on on desktop safari.

    For other browsers, you'll probably have to use the desktop app and manually copy/paste just like for IE.

    I also remember seeing some third-party integration for the windows terminal app and various Linux terminals, but I can't really speak to their quality or functionality since I haven't used them. But that would probably cover your needs for terminal based browsers like Lynx.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (2 replies)
  • [–] 5 points 1 year ago

    Not an iOS user and it certainly seems like something they would be behind on, but with Android every password manager with a Android app will work since the hooks are built directly into Android. Other than websites and apps that don't implement passwords properly it works pretty well.

  • source
  • parent
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [–] 46 points 1 year ago (9 children)

    I assure you, the rare security issues for password managers are far preferable to managing compromises every couple weeks.

  • source
  • parent
  • hideshow 9 child comments
  • [–] [S] 17 points 1 year ago (8 children)

    I've only really been in one breach. This one is actually a breach of a "security firm" (incompetent idiots) who aggregated login data from the dark web themselves, essentially doing the blackhats' work for them.

    This is also EXACTLY why requiring online interactions to be verified with government ID is a terrible idea. Hackers will similarly be able to gain all possible wanted data in a single location. It's simply too tempting of a target not to shoot for.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 11 points 1 year ago (3 children)

    I currently have 110 unique user+password combos. I wouldn't want to change all those even once, if I were breached and had used similar credentials everywhere.

    Bitwarden keeps them well managed, synced between devices, and allows me to check the whole database for matches/breaches via haveibeenpwned integration. Plus because I prefer to keep things in-house as much as possible, I even self-host the server with vaultwarden walled off behind my own vpn, instead of using the public servers. (this also means it's free, instead of a paid service)

  • source
  • parent
  • hideshow 3 child comments
  • [–] 9 points 1 year ago (2 children)

    For everyone else reading, bitwarden is an open source free password manager. The pro features are less password related and more about sharing access, file storage, and 2fa authenticator integration

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 year ago (1 child)

    Fair point.

    The self-hosting part was mostly about total control over my own systems and less about the paid features. It's very much not necessary.

    As far as pro features go, It was the TOTP authenticator integration that was kind of important to me. ~20% of my accounts have TOTP 2fa, and bitwardens clients will automatically copy the latest 2fa code into the clipboard when filling a password.

    Bitwarden will even tell you if a saved account could have 2fa (the service offers it), but it's not setup/saved in bitwarden atm.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (1 reply)
  • If you think you've only been in one breach, you're probably mistaken or very young. I don't know how many breaches I've been involved in, but it's at least double digits.

    I'm American, and my Social Security number has been leaked multiple times. Each time I've done everything possible to secure my accounts (random passwords, TOTP 2FA where possible, randomized usernames, etc), yet there's always a new breach that impacts me.

    I'm not too worried though. My important accounts are pretty secure. I use one of the few banks (brokerage actually) that provides proper 2FA. My email and password manager use 2FA. My credit is frozen. Breaches happen, the important thing is to limit the impact of a breach.

  • source
  • parent
  • [–] 20 points 1 year ago (7 children)

    Don't download shit from random websites... make sure its from legit places...

  • source
  • parent
  • hideshow 7 child comments
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [–] 7 points 1 year ago*

    I believe they are replying to the article you posted in regards to the download from legit sites comment, not the fact that the sites have shit web practices (which while correct is a different thing).

    To the people who didn't read the article posted in the comment prior, basically the software installed wasn't the legitimate software, it was a modified software that was a trojan that was forwarding passwords stored in the keepass database to a home server.

    That's not something that the sites are going wrong, nor is it the password managers fault. That's fully the users fault for downloading a trojan.

  • source
  • parent
  • [–] 5 points 1 year ago

    Not from what the article says

    involves compromised download links and trojanized versions of the legitimate KeePass application that appear identical to the authentic software on the surface, while harboring dangerous capabilities beneath.

  • source
  • parent
  • load more comments (3 replies)
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [+] 14 points 1 year ago (6 children)
  • [–] 5 points 1 year ago (1 child)

    That is assuming that someone will sit there and try to decrypt password rules for that specific person. Chances of that happening are basically 0, unless they are some sort of a high interest person.

  • source
  • parent
  • hideshow 1 child comment
  • If there's a leak with multiple services, it's possible some script kiddie will flag it as having a pattern. I'm guessing the rule is simple enough that an unsophisticated attacker could figure it out with several examples.

    It's way better than reusing passwords, but I don't think it's better than a password manager, and it takes way more effort esp given all the various password rules companies have (no special characters, must have special character, special character must be one of...). If you're paranoid, use something like keypassxc that's just a file.

  • source
  • parent
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • I don't know your rule, but when I hear this, usually it includes the name of the service or something, so a script kiddie armed with a levenstein distance algo could probably detect it.

    That said, the "safer than the person next to you" rule applies here. You're probably far enough down that list to not matter.

    As for password manager breaches, the impact really depends on what data the password manager stores. If all decryption is done client-side and the server never gets the password, an attacker would need to break your password regardless. That's how Bitwarden works, so the only things a breach could reveal are my email, encrypted data, and any extra info I provided, like payment info. The most likely attack would need to compromise one of the clients. That's possible, but requires a bit more effort than a database dump.

  • source
  • parent
  • load more comments (3 replies)
  • [–] 8 points 1 year ago (8 children)

    Also, length is most of what matters. A full length sentence in lowercase with easy to type finger/key flow for pw manager master, and don't know a single other password. Can someone correct me if I'm wrong?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 6 points 1 year ago* (2 children)

    I've found that there are a handful of passwords that you need to remember, the rest can go in the password manager. This includes the password for the password manager, of course, but also passwords for your computer/phone (since you need to log in before you can access the password manager), and your email (to be able to recover your password for the password manager).

    You are also correct that length is mostly what matters, but also throwing in a random capitalization, a number or two, and some special character will greatly increase the required search space. Also using uncommon words, or words in other languages than english can also greatly increase the resistance to dictionary attacks.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (2 replies)
  • load more comments (5 replies)
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [–] 7 points 1 year ago (4 children)

    Got any examples? Because I have…some…examples of password reuse being a real-life problem.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 5 points 1 year ago (3 children)

    LastPass recently, check Addie Lamarr’s channel on YouTube.

  • source
  • parent
  • hideshow 3 child comments
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • [–] 9 points 1 year ago (5 children)

    Something to keep in mind about not using browser integrations is that you can fall victim to simple keyloggers and clipboard stealers. But using an extension can also be a weakpoint if it autopopulates incorrectly or on a compromised site; but that's far less common.

    But, dear readers, don't let that dissuade you: even a text file in a veracrypt volume is better than "PurpleElephant1994"

  • source
  • parent
  • hideshow 5 child comments
  • load more comments (2 replies)
  • [–] a comment that isn't shown here: deleted, from someone you've blocked, or on another page. view the thread from it
  • Yes, it is better. The likelihood that someone will physically access your device is incredibly low, the likelihood that one of the services in your bucket gets leaked and jeopardizes your other accounts is way higher.

    I set mine to require my password after a period of time on certain devices (the ones I'm likely to lose), and all of them require it when restarting the browser.

    it just unlocks with a fingerprint, and I think law enforcement are allowed to force you to biometrically unlock stuff

    True, but it's also highly unlikely that LE will steal your passwords.

    My phone requires a PIN after X hours or after a few failed fingerprint attempts, and it's easy to fail without being sus. In my country, I cannot be forced to reveal a PIN. If I travel to a sketchy country or something, i switch it to a password unlock.

  • source
  • parent
  • load more comments (15 replies)