It really depends what kind of attacks you are experiencing. Account stealing? Data loss? Financial theft?
Are we talking personal or enterprise?
post
replies:
You might have a trojan or keylogger somewhere in your network
replies:
If you're placing your MFA, passwords, and security keys into the same password manager: this would be an ideal attack vector.
...also, if you're keeping your MFA separated from you passwords, but using the same technology (ie: two accounts: one for MFA and a second for passwords, both stored in bitwarden/vaultwarden): that technology could be an attack vector (ie: a weakness in the client or browser extension).
replies:
there is no perfect security.
There will always be a flaw, an exploit, a back door, a man in the middle, etc etc etc
imho, and i'm sure people will disagree, but I think all of its kinda pointless exercises to make up for the fact that end users are typically idiots that keep making passwords like "password1", and as a result creates immense false sense of security.
replies:
The term “hacking” gets tossed around to describe all kinds of different behaviors that may each require a different level of response.
You’ll get more specific help by providing more specific symptoms/behaviors.
Infostealer malware can steal session cookies, which an attacker can then use to interact with online accounts completely bypassing the password and MFA.
If you have a keylogger, everything you type in might be intercepted. Ditto for anything pasted to your clipboard.
To start, you need to make sure you have a trusted OS environment - that means wiping and reinstalling the OS using installation media that was prepared from another trusted device - not your potentially compromised device.
From there, you would have a trusted place to change all of your passwords. While in the security section of those online accounts, you would want to revoke all existing sessions. Some services have a “sign out everywhere” function, others may require manual review of each session.
If you have an email account that was compromised, be sure to check the mail forwarding settings.
For SSO accounts, audit your list of connected apps and services. Revoke and reinstate access for anything that can be set up again (e.g Google Drive Desktop App)
You’re using very secure options for a few specific areas, but security is about being systematic and comprehensive. There’s a lot of complexity, so a lot of potential holes. You probably don’t need better security on the places you already make good choices, you need to find a way to cover more possibilities.
If you’re talking about cloud accounts, there’s not much else you can do: it’s al up to the vendor.
Minor possibility: I use unique generated email addresses/usernames, in addition to unique generated passwords or passkeys. There’s authentications are hard to guess, different at every site, intruders can’t even easily connect my accounts at different cloud vendors
replies:
What OS and browser are you using? What browser extensions do you have installed?
replies:
all 25 comments