I Was Hacked.

[NotAGolf]

This thread has made me finally get my act together regarding security. I had 2FA on my email accounts, but that was all.

I've installed bit warden and moved my saved passwords from chrome to that, and downloaded authy for the 2FA side of things. Currently going through all 196 passwords I have saved and updating them to be stronger, and deleting them if no longer used. I'm also adding 2FA to any sites that offer it.

Regarding comments about writing down passwords, I don't think it's that bad of an idea, especially for things like master passwords. Just keep it safe and hidden, and most importantly, don't write it down verbatim, use a code. For example write down 'postcode of 1st house', 'colour of favourite car' or something like that. String a load of random clues together like that and it should be enough for you to remember, but not for anyone else to decipher if they were to find it.

 

[Deleted member 77746]

Haha. I'm not a moron, so I have backups of the database in three places (on-prem and off-prem); and good luck cracking AES256 with a 4096 bit key (seeded by a 30 character aA1& space password) further layered at-rest inside GPG crypt. I'll even give you a clue - it starts with '3'.

Nobody is saying you are a moron. Don't forget nobody knows the skill set of the person behind the screen. Trusting some random behind the screen is what I really mean.

Anyone taking you up on the offer yet?

 

[Beerbaron]

Glad i saw this post. I didn't realise MFA was a feature on this site Enabled

 

[Shovinus]

@Rainmaker
My suggestion of using open source 2FA clients was really only for those who don't trust larger organizations. Authy and similar large companies such as google auth are fine if you are not wearing a tin hat, there is far more for them to lose by abusing the trust than to ever gain. As for trusting some random person from a forum, that's harder to do than trusting a large organization with something to lose. I know you can't decode the passwords and 2fa codes without the master password, however technically speaking you only have to try brute forcing the master password people set up I assume and if someone uses a simple Master, which is likely, then you have a good chance of getting access to all their passwords and 2fa codes. If you create your own server, you can control the access and also place measures to stop brute force attacks etc.

For the common user, using a standard trusted password manager provider is easier than setting up their own servers and clients and is only very very very very slightly less secure, and the chance is so infinitesimally small that it is not worth worrying about, you should be more concerned crossing the street.

 

[Rainmaker]

Don't forget nobody knows the skill set of the person behind the screen. Trusting some random behind the screen is what I really mean.

Anyone taking you up on the offer yet?

I think you're mixing up the three(!) threads about MFA going in GD atm. MRK said password managers can only store passwords, so I said Bitwarden stores everything you like. That's it. Semple said so if you lose access to your Bitwarden you're screwed, but it's encrypted and you can back it up so I said not really...

For the common user, using a standard trusted password manager provider is easier than setting up their own servers and clients and is only very very very very slightly less secure, and the chance is so infinitesimally small that it is not worth worrying about, you should be more concerned crossing the street.

Again, not disputing that. I only said BW can store more than passwords and is heavily encrypted? You don't need to set up any servers to sign up with BW, they're a pretty large org and make it very simple.

 

[Deleted member 77746]

I think you're mixing up the three(!) threads about MFA going in GD atm. MRK said password managers can only store passwords, so I said Bitwarden stores everything you like. That's it. Semple said so if you lose access to your Bitwarden you're screwed, but it's encrypted and you can back it up so I said not really...

I am but it's ok to cross post, it's about the same thing

Anyway we all know what's good.

 

[mickyflinn]

I am but it's ok to cross post, it's about the same thing

Anyway we all know what's good.

Whats MFA ?

 

[Deleted member 77746]

Whats MFA ?

Multi Factor Auth

 

[Russinating]

Regarding comments about writing down passwords, I don't think it's that bad of an idea, especially for things like master passwords. Just keep it safe and hidden, and most importantly, don't write it down verbatim, use a code. For example write down 'postcode of 1st house', 'colour of favourite car' or something like that. String a load of random clues together like that and it should be enough for you to remember, but not for anyone else to decipher if they were to find it.

Maybe, but there's just no need either. If you use a passphrase as opposed to a password, which is more secure anyway, and also appears to be your suggestion, then you should have no problems remembering it.

We update our passphrase at work sometimes every 4 weeks and by the end of the day everyone has it remembered.

If you need to write it down because it's difficult to remember, what happens if you lose it or your house burns down etc?

 

[mickyflinn]

Multi Factor Auth

Could you elabarate further please is it better than 2fa ?

 

[touch]

Could you elabarate further please is it better than 2fa ?

It's another name for 2fa but can be used to cover more.
2fa = 2 factor authentication.
You can have more than 2 factors though:
4fa could be password + fingerprint + GPS location + hardware key but it would be annoying for users so most things just use 2 factors. MFA could be used to mean any number of factors, 2fa means 2 factors. So, yes, MFA could be better than 2FA but usually people mean the same thing when they use these terms.

 

[NotAGolf]

Maybe, but there's just no need either. If you use a passphrase as opposed to a password, which is more secure anyway, and also appears to be your suggestion, then you should have no problems remembering it.

We update our passphrase at work sometimes every 4 weeks and by the end of the day everyone has it remembered.

If you need to write it down because it's difficult to remember, what happens if you lose it or your house burns down etc?

Some people have better memories than others . Mine, for example, is awful . I don't have any problem remembering work passwords/pass phrases, but that's because I use them several times a day. If its for an account that I use once in a blue moon then I might need some assistance!

 

[Deleted member 77746]

Could you elabarate further please is it better than 2fa ?

MFA = just 2 or more+ methods of login.

 

[Stu999]

I’ve started using Microsoft Authenticator for here. Have to use it for work anyway so may as well add another account to it.

 

[arknor]

did they give you any implants or upgrades? oh you mean your account was hacked....

 

[mickyflinn]

It's another name for 2fa but can be used to cover more.
2fa = 2 factor authentication.
You can have more than 2 factors though:
4fa could be password + fingerprint + GPS location + hardware key but it would be annoying for users so most things just use 2 factors. MFA could be used to mean any number of factors, 2fa means 2 factors. So, yes, MFA could be better than 2FA but usually people mean the same thing when they use these terms.

Tx

MFA = just 2 or more+ methods of login.

Tx

 

[V F]

What do you mean it's handwritten??

Please tell me that doesn't mean it's written down on a scrap bit of paper in your wallet or desk drawer.

At least someone needs physical access to that draw with the password book in it. That's of course if the passwords are all different for every account across the web.

I couldn't imaging writing down 160 different password combinations.

Yes, my book is stupidly big.

It must be going as far back as 2004. Before that it was just A4 sheets of paper folded in half and stacked.

 

[Housey]

Been using Authy for a while, seems decent…

 

[mickyflinn]

Been using Authy for a while, seems decent…

Would agree it took less than a minute to get up and running.

 

[jonneymendoza]

They don't force you. It's optional.

1password is pretty good. it forces u to use 2fa when registering your 1password on a new device