• @[email protected]
      link
      fedilink
      English
      325 months ago

      I feel like atleast one of these has been hacked at some point in the past, but I cant remember which.

      • @[email protected]
        link
        fedilink
        English
        505 months ago

        It was LastPass, but the passwords themselves weren’t leaked. All of these encrypt the password.

        • @[email protected]
          link
          fedilink
          English
          225 months ago

          the passwords themselves weren’t leaked

          You’re not wrong, but you kinda are. The plaintext passwords weren’t released, but the encrypted blobs were stolen. Unfortunately, the LastPass defaults were absolutely shit so people have been able to selectively attack the blobs and decrypt the vaults, leading to millions in crypto being stolen.

          I was a long time supporter of LastPass, but they haven’t been responsible stewards of sensitive information. The fact that they failed to encourage or force existing customers to update the encryption settings as they updated their defaults is negligent and is disqualifying in my opinion.

        • @[email protected]
          link
          fedilink
          English
          195 months ago

          There is no excuse for LastPass and it absolutely should not be treated with your passwords or secrets.

          • @[email protected]
            link
            fedilink
            English
            45 months ago

            Security Now is amazing. For anyone that wants the deep dive tech perspective, plus what it means for everyday people and users, this is a great option.

        • @[email protected]
          link
          fedilink
          English
          45 months ago

          Ah, alright, thanks. Thats a good thing then, that you cant get to the passwords even if you hack the company.

      • @[email protected]
        cake
        link
        fedilink
        English
        185 months ago

        KeePass doesn’t store your stuff in the cloud; it’s all local storage. You can sync your encrypted KeePass DB in a number of different ways; personally, I go for SyncThing, but you can use Box or whatever.

    • fmstrat
      link
      fedilink
      English
      21
      edit-2
      5 months ago

      Based on experiences helping people migrate away, I’d suggest removing LastPass from your list. See other replies for why.

      Note: For those that care, not only is BitWarden FOSS, it can also be self hosted easily using VaultWarden.

      • @[email protected]
        link
        fedilink
        English
        65 months ago

        I added a note. I personally use Bitwarden and would recommend it, but I didn’t want to give a biased recommendation. If, for whatever reason, one of the others works better for someone, just using an encrypted password manager is way better than not.

        • fmstrat
          link
          fedilink
          English
          25 months ago

          Oh I feel you. I did a ton of research on toilet paper (of all things) and made a recco and my post was deleted as an “ad”, hah

      • Ghoelian
        link
        fedilink
        English
        35 months ago

        Only issue I have with 1Password is their Android app. It works great most of the time, except that they didn’t implement the Android autofill stuff correctly.

        It sees Firefox as a browser and offers autofill suggestions for the websites just fine, but apparently Fennec isn’t on their allowed browser list or something. It just sees Fennec as another android app and doesn’t offer logins for the website I’m on, just ones that I’ve linked to the Fennec app.

    • @[email protected]
      link
      fedilink
      English
      235 months ago

      About 1/3 had not been previously seen in the have I been pwnd database, that’s really crazy. Either this was a very new or private list of exploited accounts.

      • @[email protected]
        link
        fedilink
        English
        75 months ago

        The good thing (for me personally) is that only some very old mail aliases of mine are in this collection. Which means that using a password manager to create and save all my passwords for years does have a positive effect.

        • @[email protected]
          link
          fedilink
          English
          -115 months ago

          A password manager is irrelevant for Have I Been Owned, since the site only matches emails, not passwords. Also, that site includes mega lists which mix and match data from different services as well as spam lists… Not terribly useful.

          PM’s and avoiding reuse are still vital despite that.

    • Mike
      link
      fedilink
      English
      205 months ago

      Ya know, I have no issues with 2fa, but I watch older folks struggle with it for some reason. They can’t fathom the ‘magic’. But I don’t understand 2fa on utility websites that are only payment portals that obfuscate account numbers. Like “enable 2fa for account security!” why? Because someone who has found my credentials on the dark web might pay my bill?

      • @[email protected]
        link
        fedilink
        English
        75 months ago

        They can use the information to try to send you fake invoices to try to scam you, or use your personal information to social engineer you or your relatives, attempt identity theft etc. Basic info-sec is still important. It’s like leaving the bathroom door open when you poop. It probably isn’t going to hurt you if you leave it open but its still probably a good idea to shut the door if its a public restroom

        • Mike
          link
          fedilink
          English
          45 months ago

          Alright, that makes some sense. Fair enough.

      • @[email protected]
        link
        fedilink
        English
        25 months ago

        I’m also trying to find the angle on it. Like with my ISP I guess someone could have my password but not necessarily my address? So from the ISP site they could peek at my address??? I’m not even sure it has my address unobfuscated but I figure it must somewhere, like “view this bill”.

        • brianorca
          link
          fedilink
          English
          3
          edit-2
          5 months ago

          A lot of ISPs provide email, too. So getting an ISP password lets them reset your other passwords which used that email address for the “forgot password” prompt. (I’m guessing you don’t use your ISP provided email, but you’re not “most people”.)

    • @[email protected]
      link
      fedilink
      English
      145 months ago

      As long as that factor is auth app based, and not email/text/call/proprietary app I’m all in. If I need to go digging for the second factor for 5 minutes, I’m almost always going to turn it off. Texts emails and calls all get delayed regularly, and it’s super fun to have to sit with my thumb up my ass waiting 10 minutes for an OTP that was good for 5.

      • @[email protected]
        link
        fedilink
        English
        55 months ago

        I think for email it’s essential, it’s critical that someone doesn’t make it into your email. Otherwise they can reset all your other passwords.

        I have mfa on my account but I just click a checkbox after first time to not ask again. I’m still protected by it and don’t have to do anything until I clear my cookies (which I don’t for email).

        • @[email protected]
          link
          fedilink
          English
          2
          edit-2
          5 months ago

          I think they’re thinking of TOTP noy being the standard, where you’d just pull out your totp app and paste it without waiting

          • @[email protected]
            link
            fedilink
            English
            25 months ago

            Precisely, my brain just completely forgot the term for it and after minutes of not being able to remember for the list of my I just loosely described it. TOTP is exactly what I meant.

      • @[email protected]
        link
        fedilink
        English
        55 months ago

        Ideally they also support a hardware key. Not nearly enough websites out there support FIDO/Webauthn.

      • HubertManne
        cake
        link
        fedilink
        15 months ago

        I wish more were like azure where you can get a phone call and hit pound

        • @[email protected]
          link
          fedilink
          English
          35 months ago

          That’s also a less secure version of 2fa. Granted, it is still better than nothing, but sim spoofing is still a thing that happens regularly. Making it much less useful in a targeted attack.

          • HubertManne
            cake
            link
            fedilink
            25 months ago

            over texting or an app. because an app requires a smartphone.

            • @[email protected]
              link
              fedilink
              English
              25 months ago

              A smartphone is infinitely more secure than relying on a SIM card not being compromised. A little social engineering can get you access to receive a text as the link isn’t even controlled by you but a third party. An app on your phone is likely secured by a pin/biometric, and a password/pin/biometric, both controlled by you.

              • HubertManne
                cake
                link
                fedilink
                25 months ago

                yup. if you have or care to have a smartphone. having a smartphone or even a cell phone should not be some sort of requirement live in society.

                • @[email protected]
                  link
                  fedilink
                  English
                  0
                  edit-2
                  5 months ago

                  Oh cmon, you can get a smartphone literally for free these days. And yes, having a cell phone of some type is pretty much a requirement to live in the 23rd century. Even if you are just communicating over free McDonalds wifi (no shame, been there done that) you pretty much need a smart phone in the modern world.

      • @[email protected]
        link
        fedilink
        English
        15 months ago

        One time I had to use a website where the email 2FA expired in 30 seconds! I usually keep my email client open while my computer is on, but, come on, that was ridiculous.

  • AutoTL;DRB
    link
    fedilink
    English
    115 months ago

    This is the best summary I could come up with:


    Nearly 71 million unique credentials stolen for logging into websites such as Facebook, Roblox, eBay, and Yahoo have been circulating on the Internet for at least four months, a researcher said Wednesday.

    breach notification service, said the massive amount of data was posted to a well-known underground market that brokers sales of compromised credentials.

    Hunt said he often pays little attention to dumps like these because they simply compile and repackage previously published passwords taken in earlier campaigns.

    This isn’t just the usual collection of repurposed lists wrapped up with a brand-new bow on it and passed off as the next big thing; it’s a significant volume of new data.

    When you look at the above forum post the data accompanied, the reason why becomes clear: it’s from ‘stealer logs’ or in other words, malware that has grabbed credentials from compromised machines.”

    For added assurance, Hunt also checked a sample of the credentials to see if the email addresses were associated with accounts on the affected websites.


    The original article contains 645 words, the summary contains 167 words. Saved 74%. I’m a bot and I’m open source!

  • Ebby
    link
    fedilink
    English
    -1
    edit-2
    5 months ago

    Whoa, had no idea haveibeenpwned charged subscriptions to search a domain >10 addresses now.

    Using unique addresses since 1998 is quite expensive.

    EDIT: Really, down votes? Nothing I said was wrong even if it’s not fun hearing. I don’t like it either. Linky I have 35 addresses found in breaches but can’t tell which ones because it’s $169.50/year or $16.95 if I subscribe and cancel to search each time.