4 ms·

Not a mail.you get that message when logging in to Google. I first thought that too.and tried another browser ( got that message in Vivaldi first,than tried IE

Not a mail.you get that message when logging in to Google. I first thought that too.and tried another browser ( got that message in Vivaldi first,than tried IE) Same result. Here are some old articles about that: https://www.recode.net/2017/3/24/15054954/google-reassures-users-government-backed-hackers https://www.recode.net/2017/3/24/15054954/google-reassures-u... http://www.zdnet.com/article/google-heres-why-you-shouldnt-flip-out-over-government-backed-hacker-alerts/ http://www.zdnet.com/article/google-heres-why-you-shouldnt-f...

buschkowitz 9y ago
Yea, it does look legit after reading the articles you posted. I am not a hacker per se, but I guess uncovering what a gov hacker did in your account is highly difficult. In terms of safety, use a password manager that creates and stores hard-to-crack passwords for you. I am pretty happy with Dashlane, 1password has a good reputation, too.
- zaphirplane 9y ago
  What ! Don’t use a password manager and turn on 2 factor Authentication
  - amingilani 9y ago
    Absolutely use a password manager, and a strong passphrase for the master password [1] Why would you say not? I'm not trying to be rude or anything. Let's have a discussion, and if I can convince you to do use one, I'd have made one more person safer. [1] I made this for a dead simple way to make passphrases: https://amingilani.github.io/password-maker/ https://amingilani.github.io/password-maker/
    - herbst 9y ago
      Not OP but open for a chance. Last time I checked the popular password managers saved the passwords in one way or another. Which personally simply sounds like a bad idea to begin with. Even if in theorie they are safe. Even the slight chance that a single failure could lead to all my passwords getting in the wrong hands at once just is to scary.
      - Angostura 9y ago
        I must admit, I use Apple’s Keychain, I wouldn’t trust a third party app.
      - chopin 9y ago
        Do you have citations for this? AFAIK state of the art is to put the password through some password stretching algorithm (like PKBDF) and to encrypt the database with that. No need to store the password. I think NaCL offers out-of-the-box support for this. EDITED to add: I am using Password Safe which is recommended by Bruce Schneier. What you describe would be an absolute noob mistake. He would be pretty embarrassed if you were right.
        icebraining 9y ago
        I think herbst is saying that password managers store the passwords being managed, not the master password used to encrypt the DB.
      - mercer 9y ago
        How do you propose one memorizes a properly random/secure/long password, let alone multiple ones, without trusting 'something' with it, whether a password manager of good repute, a hand-rolled version with potentially bigger security issues, or a piece of paper somewhere?
        c22 9y ago
        I've memorized multiple long passwords, and routinely memorize new ones. Also phone numbers, poems, mailing addresses, digits of pi, etc. It's not really that challenging. Especially if you do it often.
        zaphirplane 9y ago
        Your password doesn’t need be a long random string, just a long unguessable one and safe from dictionary attacks Ilikeapples! Is fine But You know I’m not a security researcher
      - 9y ago
    - chomp 9y ago
      Not parent but I'm guessing the rationale is that a password manager could undermine the concept of 2fa. Some believe that the "something you know" should be stored inside your head. I personally use a password manager, but can understand the viewpoint. Password managers lie somewhere between 2 different factors, "have" (the password DB) and "know" (only your master password). For those who use a laptop as their 2nd factor (yubikey plugged into a USB port, a token on the system itself) and get their laptop stolen, a compromise of the password safe could result in both factors being breached.
    - zaphirplane 9y ago
      Because The security of your passwords depend on the security of the password manager and the security of their infrastructure ... the big password managers have had issues, in code, design and even last pass was attached by hackers. trusting your bank / email and other important password is an unneeded risk. Your turn why should I rely on someone and their servers to save my passwords why a good password and 2fa will protect my account?
DyslexicAtheist 9y ago
interesting. does anyone know how ProtonMail handles such situations and whether they alert their users?

buschkowitz 9y ago

Yea, it does look legit after reading the articles you posted. I am not a hacker per se, but I guess uncovering what a gov hacker did in your account is highly difficult. In terms of safety, use a password manager that creates and stores hard-to-crack passwords for you. I am pretty happy with Dashlane, 1password has a good reputation, too.

zaphirplane 9y ago
What ! Don’t use a password manager and turn on 2 factor Authentication
- amingilani 9y ago
  Absolutely use a password manager, and a strong passphrase for the master password [1] Why would you say not? I'm not trying to be rude or anything. Let's have a discussion, and if I can convince you to do use one, I'd have made one more person safer. [1] I made this for a dead simple way to make passphrases: https://amingilani.github.io/password-maker/ https://amingilani.github.io/password-maker/
  - herbst 9y ago
    Not OP but open for a chance. Last time I checked the popular password managers saved the passwords in one way or another. Which personally simply sounds like a bad idea to begin with. Even if in theorie they are safe. Even the slight chance that a single failure could lead to all my passwords getting in the wrong hands at once just is to scary.
    - Angostura 9y ago
      I must admit, I use Apple’s Keychain, I wouldn’t trust a third party app.
    - chopin 9y ago
      Do you have citations for this? AFAIK state of the art is to put the password through some password stretching algorithm (like PKBDF) and to encrypt the database with that. No need to store the password. I think NaCL offers out-of-the-box support for this. EDITED to add: I am using Password Safe which is recommended by Bruce Schneier. What you describe would be an absolute noob mistake. He would be pretty embarrassed if you were right.
      - icebraining 9y ago
        I think herbst is saying that password managers store the passwords being managed, not the master password used to encrypt the DB.
    - mercer 9y ago
      How do you propose one memorizes a properly random/secure/long password, let alone multiple ones, without trusting 'something' with it, whether a password manager of good repute, a hand-rolled version with potentially bigger security issues, or a piece of paper somewhere?
      - c22 9y ago
        I've memorized multiple long passwords, and routinely memorize new ones. Also phone numbers, poems, mailing addresses, digits of pi, etc. It's not really that challenging. Especially if you do it often.
      - zaphirplane 9y ago
        Your password doesn’t need be a long random string, just a long unguessable one and safe from dictionary attacks Ilikeapples! Is fine But You know I’m not a security researcher
    - 9y ago
  - chomp 9y ago
    Not parent but I'm guessing the rationale is that a password manager could undermine the concept of 2fa. Some believe that the "something you know" should be stored inside your head. I personally use a password manager, but can understand the viewpoint. Password managers lie somewhere between 2 different factors, "have" (the password DB) and "know" (only your master password). For those who use a laptop as their 2nd factor (yubikey plugged into a USB port, a token on the system itself) and get their laptop stolen, a compromise of the password safe could result in both factors being breached.
  - zaphirplane 9y ago
    Because The security of your passwords depend on the security of the password manager and the security of their infrastructure ... the big password managers have had issues, in code, design and even last pass was attached by hackers. trusting your bank / email and other important password is an unneeded risk. Your turn why should I rely on someone and their servers to save my passwords why a good password and 2fa will protect my account?

DyslexicAtheist 9y ago

interesting. does anyone know how ProtonMail handles such situations and whether they alert their users?