8 ms·

Not Getting Hacked

dataflow 4y ago
> Use a password manager that fills in fields automatically (EDIT: To everyone saying this is a bad idea: yes I agree, and that's unrelated to my question. Before reading my subsequent paragraph, note this sentence can be interpreted two different ways. I thought it meant "automatically" as in "without needing to manually copy-paste" (to avoid phishing), but it seems maybe the intention was "without prompting the user"? The second one seems like bad advice and not what I was asking about regardless - I'm asking about the anti-phishing fill where the program enters the text, NOT about unprompted filling, which I already agree is a bad idea.) It's not this simple in reality is it? Surely it's not just me whose password manager often has to prompt to fill in a legit website it can't recognize, because the domain or URL isn't the same as what it has stored in its database? Are non-technically-inclined folks expected to be able to follow this advice in practice?
- latchkey 4y ago
  I turned this off. It is possible that the site gets hacked and your password manager automatically fills it in, the attacker now can read the password (via embedded javascript) that you've filled into the field without even submitting it first. By making this a manual process, it at least gives you a fighting chance.
  - brigandish 4y ago
    How would you know that the site's been hacked, and if you do, why would you visit it?
    - autotune 4y ago
      I recently was looking into the possibility of finding a local tax prep service for the mess that is my taxes from 2020. I stumbled upon a website that was highly rated on Google and looked completely professional, so naturally I let my guard down a bit while browsing it. Before I knew it one of their navigation links in this otherwise professional looking site redirected me to some malware spewing porn site that probably would have downloaded and installed itself on my machine if I was not using uBlock Origin and on Mac. It's super easy to get tricked these days even when you are security conscious 95 percent of the time, it only takes that one 5 percent chance to go wrong.
    - latchkey 4y ago
      I don't know that the site has been hacked, that's the point. I'd rather not automatically throw my password into a form when I visit a site. It seems like a kind of obvious thing to me.
      - albuic 4y ago
        The goal of a password manager is to use random password, one generated for each website, so that if one is leaked... Well, nothing more ! So having autofill is a good feature.
        latchkey 4y ago
        Sure and I use that feature... But, you aren't thinking like a hacker. Leaking one site could allow someone access into another site. For example, if I've integrated API keys from one site into another. It is those sorts of targets that hackers really look for.
  - knaik94 4y ago
    It shouldn't matter as long as you don't reuse your password. If the site is hacked to the point where someone can inject javascript, I'd assume all of my data has already been compromised without logging in.
    - latchkey 4y ago
      > I'd assume all of my data has already been compromised without logging in. Not entirely true. If the site requires your login in order to, say, decrypt your server side data, then even if the site is compromised, your data is still secure, until you log in. I'm making this up as a possibility, I've never seen or heard of a site that actually did that. Regardless, I'd rather error on the side of caution. There are too many things that I don't know about here that could be possible. Automatically filling in my password somewhere seems like an obvious thing to be cautious about.
      - albuic 4y ago
        > I've never seen or heard of a site that actually did that. Protonmail maybe ;-)
        latchkey 4y ago
        That's actually a good example!
- senectus1 4y ago
  I'd suggest that auto filling is a bad idea. i have bitwarden auto fill when i use a hotkey combo. That, in my mind is safer. For the very reason he mentions down the page : >Use tools so you can't mess up even if you're not paying attention. *Note its worth noting that this hotkey combo only works on sites that you have logged against that password. it wont just blurt out the next password.
- chrsjxn 4y ago
  I'm not sure I get the issue people have with autofilling passwords, instead of making the user copy and paste. Every password manager I've used associates those credentials with a URL. One of my accounts used to get them confused, because the company offered a dedicated login page and login via the home page on separate subdomains. So that feature might make it harder to get phished by adding friction. And if an attacker has malicious code running on the legitimate website, how would you know?
- TechBro8615 4y ago
  Aside from the phishing issue, which I don't find convincing anyway, auto-filling vs. copy/paste is a choice between browser extension security and clipboard security. Personally, I use 1Password without any browser extension and I choose to copy/paste my password from the 1Password app into the password field on a website. Usually I type the username/email manually. If my clipboard is compromised, then an attacker will get only the password for only the current website. They won't even know the username or website it's associated with. On the other hand, if a browser extension for my password manager is compromised, the impact could be much more severe and widespread. In some scenarios an attacker could read my entire vault. Also, if my clipboard is compromised, then probably so is my entire OS, in which case all my browser extensions are too. This is my personal preference, but frankly I think it's just bad advice to use a browser extension with your password manager, and especially bad advice to use one with auto-filling behavior.
blondin 4y ago
nice list, but not sure about password managers... especially in light of what is currently going on with lastpass. a lot of phishing will come out of that to trick users to give away their master password. then what? or what if google, apple, what have you, ban your account? there is no silver bullet. we need a lot common sense and not preaching in absolute terms.
- dylan604 4y ago
  >not sure about password managers... especially in light of what is currently going on with lastpass. i would counter with don't use cloud based password managers. i'd go so far as don't use cloud based anything, but that ship has sailed. i use a password manager, but do not use the cloud offerings of it. i can sync all of my devices to the same database, but yes i have to do it. >99% of people will prefer the convenience over security, so as a founding father once said, give them neither (or something like that).
- knaik94 4y ago
  At least Google's password manager is tied to your login, which should be a lot better protected and people wouldn't give away that password as easily. You can always export your passwords, they're not locked into a password manager.
  - albuic 4y ago
    Password manager database are almost standardised for open source products.
- cuu508 4y ago
  > a lot of phishing will come out of that to trick users to give away their master password One thing you can do to mitigate is to set up WebAuthn 2FA for the password manager as well. If your master password somehow leaks (say, a keylogger), the attacker still cannot access the vault since they don't have access to your security key.
  - eks391 4y ago
knaik94 4y ago
I am frustrated by password managers auto-generating nonsense. It increases the friction in moving away from a specific manager and people essentially become locked out of accounts if they can't access their password manager. I imagine that leads to weaker passwords anyway for things like shared accounts. I like the encrypted sync between my devices but never use the suggested passwords. Using TOTP 2FA should be the primary second factor enforced everywhere. If you use Aegis on android or Raivo for ios, you control your 2FA secrets and can make encrypted cloud backups. I can't see myself ever using YubiKeys or Passkeys because I don't want to worry about hardware failure. Additionally, the chrome/ios roll out of passkeys requires it to be associated with your Google/Apple account and is tied to your login. Google passkeys don't support linux and don't plan to. Veracrypt is stable and replaced truecrypt for me years and years ago. I am not sure why bitlocker would be recommended over Veracrypt. For true full-disk encryption, I thought it was still best to use a BIOS/UEFI set password so the prompt happens before boot. My understanding is that this is independent of OS. From the last time I checked, bitlocker has slightly better OS integration, but veracrypt allows compatibility and decryption with linux. I like veracrypt for situations where I need things to be portable and able to be backed up in the cloud or need access across OSes. Is there a benefit in using bitlocker? I like GitHub's push in this area. When ssh keys were first being forced for signing/authentication for commits, I was annoyed that I couldn't use passwords. But I realized that I was more annoyed about having to change my workflow, and it doesn't slow me down now that I've done it a few times. https://xkcd.com/936/ https://xkcd.com/936/
TedDoesntTalk 4y ago
> use oAuth login. This looks like "Sign in with Google", "Sign in with Apple", "Sign in with GitHub", etc. I'm pretty happy using Google's oAuth everywhere No, don’t ever do this. 1. Google or Facebook or Apple now know everywhere you have an account 2. If they choose to disable your access to their service (as happens regularly and without due process), you can’t login to any website.
- knaik94 4y ago
  I trust Google login and oAuth to be protected with better security practices than the general login. AdSense and other cookies means they probably know where you have an account regardless of if you login. I like that "Sign in with Google" allows me to not make another login and password. For certain sites, after using "Sign in with Google", they have made me make a local account anyway as backup. I don't think a generalization like "don't ever do this" is helpful. I am curious why you say blocked accounts happens regularly. I have heard of it happening to people, but not often.
  - TedDoesntTalk 4y ago
    What will you do if Google decides you’ve broken some terms of service and you lose access to gmail and all other Google resources? You are giving them the power to disable access to non-Google websites. And you’re ok with that? HN is littered with people who’ve experienced Google bans. An article hits the front page about it seemingly monthly (and those are only the ones that get publicized). It happens again and again. You have no recourse. There is no one to call. There is never an explanation. I’m not here to convince you. To each his own. If you dont care about the privacy leaks, then surely you can overlook the risk of losing access to your non-Google accounts whenever Google decides.
    - deleted 4y ago
      [deleted]
    - Arainach 4y ago
      Then I create an account with my new email. Sure, for the few sites I care deeply about a long history with, a unique account might be worth it. Those sites are few and far between. My password manager has more than 500 entries. A huge majority are sites I used once and never again. I don't want an account there but was probably required to create one to check out. If Google deleted them they'd be doing me a favor. Google knows I went to those sites anyway since I probably found them through search results.
cybrexalpha 4y ago
Good list, but I think it actually understates the advantage of security keys over other methods of 2FA. It's not just that they're physical objects, it's the protocol (either FIDO U2F or FIDO2/Webauthn) is fundamentally resistant to phishing attacks. Take the author's example of accidentally logging into accounts.google.com.evil instead of accounts.google.com: If you and/or your password manager are tricked and enter your username and password, all other 2FA methods are vulnerable to an active pishing attack where the attacker site relays the login information to the real site in real time. You enter your TOTP code or hit "yes" on a push notification or whatever, the real site logs you in and passes your session cookie to the attacker and you're hacked. With a security key when you log in the browser tells the key what website you're connecting to and about its TLS certificate. If the security key wasn't registered with it exactly, it won't work. It's almost impossible* to get phished if you use a security key as your 2FA method. * There are few ways. If you're phished during first time setup of the security key, or if the attacker gets a valid TLS cert for their website and impersonates accounts.google.com with a network level attack, or if they manage to get a trusted private CA onto your machine and do the same, or if they can exploit a 0day in the browser or the key to disrupt that communication and lie to the security key about the site's identity. But the bar for these forms of attacks is significantly higher.
- jefftk 4y ago
  I do think the post covers this? This is specifically why I advocate for security keys over TOTP ("they protect you against fake login pages").
seee-I-Told-you 4y ago
While the list is certainly good precautions which everyone for the most part should be implementing and thinking about, it is not a complete list. Even though the author would say "it was not intended to be" it still kind of promises "these mitigations are enough".. and of course the world isn't black and white. Protecting a company or even a sole personal computer is a time staking challenge with multiple dimensions. It involves implementing processes and routines which you stick to, it involves technical solutions for mitigating threats in different categories and it involves planning, configuration and monitoring. It certainly involves staying well informed on vulnerabilities, present threats and the modus operandi of attackers. That's why we security consultants (on a senior level) are more or less useless unless we are developers ourselves and stack 30 000 + hours in experience. And still, with all this experience and knowledge the work is not a piece of cake at all. You have to be prepared to make exceptions, be pragmatic, a good communicator and a good skilled presenter. You have to be prepared to work uncomfortable hours, holidays, weekends etc.
devdiary 4y ago
Using "password manager for everything" comes with a critical disadvantages of making the pass mgr a single point of failure, increasing attack surface area. Take an example of recent Lastpass breach, I am pretty sure it will lead to hacking almost all services for some Lastpass users. Although Lastpass is saying - don't worry, your passwords are encrypted with your master password and it will take million yrs to crack them. No, it won't take even a month/day to crack master password of many of those users. You're overestimating people's ability to create strong master password and the efforts needed in cracking a password. I'd rather be very specific in suggesting password managers, use them only for non-critical services.
- xcdzvyn 4y ago
  Hard disagree. The problem with Lastpass being pwned was Lastpass being Lastpass. Put your passwords in a password manager, don't put your passwords on the internet in The Cloud™. > You're overestimating people's ability to create strong master password and the efforts needed in cracking a password. Okay - so we're establishing that many people use insecure passwords. Password managers mitigate this risk completely by generating incredibly secure passwords - however, people may use an insecure master password. > I'd rather be very specific in suggesting password managers, use them only for non-critical services. And your proposed solution is for people to use NO secure passwords, but to use their poor password creation abilities on every site they use. This only leads to people using insecure passwords _everywhere_, rather than in one, local file, which is far less likely to be attacked.
  - darkwater 4y ago
    > Put your passwords in a password manager, don't put your passwords on the internet in The Cloud™. Which doesn't work well in a multi-devices landscape as the one we live in for many people (even if not the majority, because the majority probably just owns and uses a smartphone).
    - albuic 4y ago
      It works well for me, you just need to synchronize your password manager's file once in a while. Are you really creating that many accounts ? And you can use anything even cloud providers to easily synchronize the single file. I don't use cloud password managers, history has shown it is too risky.
abhaynayar 4y ago
I think self-pwning by running executables downloaded from torrents/shady websites might be a common way people get hacked. A while back I was talking to a bunch of software developers and even they were not convinced that you can get hacked by running games from torrents. What's worse is people also run that stuff as administrator, and then ask their anti-virus to ignore it.
- rl3 4y ago
  >A while back I was talking to a bunch of software developers and even they were not convinced that you can get hacked by running games from torrents. Untrusted executable code that's expected to be a modified version of the real thing, making hash-based assurances impossible in most cases. Sounds secure to me. /s It's kind of sad, in the days prior to torrents security used to be reputation-based. Not to mention a dynamic where reversers look at each other's work. Since the advent of torrents and with just the sheer amount of games now, I imagine that's suffered quite a bit. Some forms of DRM are arguably malware in and of themselves, so it's ironic that attempts at bypassing that end up as a vector for serious malware. What worries me is since Steam opened its floodgates, theoretically lesser-known titles could be vectors for malicious code. Or heck, even larger titles. What assurances are there, actually? Trust in the publisher and developer is about it.
  - intelVISA 4y ago
    Last I checked a decent amount of games on Steam ship with malware like Denuvo so you're probably right.
kkfx 4y ago
Mh, I found this article really strange: - firstly tie ourself to a service is the best thing to do to get lock-out of something "belonging to us" but not under our control, A TOTAL NO GO. We need to own, in person, not give something to others pockets "because their are safer"; - secondly I do not want to use ANY not-personal password managers and recent attacks prove very well why; - thirdly the most simplest form of being "locked out" is that a service we depend on does not work anymore, the simplest form of protection is NOT depending on third parties. Have your own files, on personal hw, with offline LOCAL copies and a good backup strategy (of course on encrypted storage, but that might prevent a thief access the information NOT ensure the availability of something) is a good lock-out prevention. Having a personal mail infra is hard, but owning a domain name and have a LOCAL mailserver at home that just use someone else service as a replica ensure you have the mails and the domain, being "locked out" means just being offline until you restore, still being able to read your mails and eventually move your domain somewhere else and that's far less harder. Having a personal website instead of using some platform is another nice way, especially if you advertise you have also a ZeroNet and similar P2P systems copy, so even if the website is hosted by some provider your readers know there is a LIVE copy in a P2P distributed system and eventually they even have a local copy.

> Use a password manager that fills in fields automatically (EDIT: To everyone saying this is a bad idea: yes I agree, and that's unrelated to my question. Before reading my subsequent paragraph, note this sentence can be interpreted two different ways. I thought it meant "automatically" as in "without needing to manually copy-paste" (to avoid phishing), but it seems maybe the intention was "without prompting the user"? The second one seems like bad advice and not what I was asking about regardless - I'm asking about the anti-phishing fill where the program enters the text, NOT about unprompted filling, which I already agree is a bad idea.) It's not this simple in reality is it? Surely it's not just me whose password manager often has to prompt to fill in a legit website it can't recognize, because the domain or URL isn't the same as what it has stored in its database? Are non-technically-inclined folks expected to be able to follow this advice in practice?

latchkey 4y ago
I turned this off. It is possible that the site gets hacked and your password manager automatically fills it in, the attacker now can read the password (via embedded javascript) that you've filled into the field without even submitting it first. By making this a manual process, it at least gives you a fighting chance.
- brigandish 4y ago
  How would you know that the site's been hacked, and if you do, why would you visit it?
  - autotune 4y ago
    I recently was looking into the possibility of finding a local tax prep service for the mess that is my taxes from 2020. I stumbled upon a website that was highly rated on Google and looked completely professional, so naturally I let my guard down a bit while browsing it. Before I knew it one of their navigation links in this otherwise professional looking site redirected me to some malware spewing porn site that probably would have downloaded and installed itself on my machine if I was not using uBlock Origin and on Mac. It's super easy to get tricked these days even when you are security conscious 95 percent of the time, it only takes that one 5 percent chance to go wrong.
  - latchkey 4y ago
    I don't know that the site has been hacked, that's the point. I'd rather not automatically throw my password into a form when I visit a site. It seems like a kind of obvious thing to me.
    - albuic 4y ago
      The goal of a password manager is to use random password, one generated for each website, so that if one is leaked... Well, nothing more ! So having autofill is a good feature.
      - latchkey 4y ago
        Sure and I use that feature... But, you aren't thinking like a hacker. Leaking one site could allow someone access into another site. For example, if I've integrated API keys from one site into another. It is those sorts of targets that hackers really look for.
- knaik94 4y ago
  It shouldn't matter as long as you don't reuse your password. If the site is hacked to the point where someone can inject javascript, I'd assume all of my data has already been compromised without logging in.
  - latchkey 4y ago
    > I'd assume all of my data has already been compromised without logging in. Not entirely true. If the site requires your login in order to, say, decrypt your server side data, then even if the site is compromised, your data is still secure, until you log in. I'm making this up as a possibility, I've never seen or heard of a site that actually did that. Regardless, I'd rather error on the side of caution. There are too many things that I don't know about here that could be possible. Automatically filling in my password somewhere seems like an obvious thing to be cautious about.
    - albuic 4y ago
      > I've never seen or heard of a site that actually did that. Protonmail maybe ;-)
      - latchkey 4y ago
        That's actually a good example!
senectus1 4y ago
I'd suggest that auto filling is a bad idea. i have bitwarden auto fill when i use a hotkey combo. That, in my mind is safer. For the very reason he mentions down the page : >Use tools so you can't mess up even if you're not paying attention. *Note its worth noting that this hotkey combo only works on sites that you have logged against that password. it wont just blurt out the next password.
chrsjxn 4y ago
I'm not sure I get the issue people have with autofilling passwords, instead of making the user copy and paste. Every password manager I've used associates those credentials with a URL. One of my accounts used to get them confused, because the company offered a dedicated login page and login via the home page on separate subdomains. So that feature might make it harder to get phished by adding friction. And if an attacker has malicious code running on the legitimate website, how would you know?
TechBro8615 4y ago
Aside from the phishing issue, which I don't find convincing anyway, auto-filling vs. copy/paste is a choice between browser extension security and clipboard security. Personally, I use 1Password without any browser extension and I choose to copy/paste my password from the 1Password app into the password field on a website. Usually I type the username/email manually. If my clipboard is compromised, then an attacker will get only the password for only the current website. They won't even know the username or website it's associated with. On the other hand, if a browser extension for my password manager is compromised, the impact could be much more severe and widespread. In some scenarios an attacker could read my entire vault. Also, if my clipboard is compromised, then probably so is my entire OS, in which case all my browser extensions are too. This is my personal preference, but frankly I think it's just bad advice to use a browser extension with your password manager, and especially bad advice to use one with auto-filling behavior.

blondin 4y ago

nice list, but not sure about password managers... especially in light of what is currently going on with lastpass. a lot of phishing will come out of that to trick users to give away their master password. then what? or what if google, apple, what have you, ban your account? there is no silver bullet. we need a lot common sense and not preaching in absolute terms.

dylan604 4y ago
>not sure about password managers... especially in light of what is currently going on with lastpass. i would counter with don't use cloud based password managers. i'd go so far as don't use cloud based anything, but that ship has sailed. i use a password manager, but do not use the cloud offerings of it. i can sync all of my devices to the same database, but yes i have to do it. >99% of people will prefer the convenience over security, so as a founding father once said, give them neither (or something like that).
knaik94 4y ago
At least Google's password manager is tied to your login, which should be a lot better protected and people wouldn't give away that password as easily. You can always export your passwords, they're not locked into a password manager.
- albuic 4y ago
  Password manager database are almost standardised for open source products.
cuu508 4y ago
> a lot of phishing will come out of that to trick users to give away their master password One thing you can do to mitigate is to set up WebAuthn 2FA for the password manager as well. If your master password somehow leaks (say, a keylogger), the attacker still cannot access the vault since they don't have access to your security key.
- eks391 4y ago

knaik94 4y ago

I am frustrated by password managers auto-generating nonsense. It increases the friction in moving away from a specific manager and people essentially become locked out of accounts if they can't access their password manager. I imagine that leads to weaker passwords anyway for things like shared accounts. I like the encrypted sync between my devices but never use the suggested passwords. Using TOTP 2FA should be the primary second factor enforced everywhere. If you use Aegis on android or Raivo for ios, you control your 2FA secrets and can make encrypted cloud backups. I can't see myself ever using YubiKeys or Passkeys because I don't want to worry about hardware failure. Additionally, the chrome/ios roll out of passkeys requires it to be associated with your Google/Apple account and is tied to your login. Google passkeys don't support linux and don't plan to. Veracrypt is stable and replaced truecrypt for me years and years ago. I am not sure why bitlocker would be recommended over Veracrypt. For true full-disk encryption, I thought it was still best to use a BIOS/UEFI set password so the prompt happens before boot. My understanding is that this is independent of OS. From the last time I checked, bitlocker has slightly better OS integration, but veracrypt allows compatibility and decryption with linux. I like veracrypt for situations where I need things to be portable and able to be backed up in the cloud or need access across OSes. Is there a benefit in using bitlocker? I like GitHub's push in this area. When ssh keys were first being forced for signing/authentication for commits, I was annoyed that I couldn't use passwords. But I realized that I was more annoyed about having to change my workflow, and it doesn't slow me down now that I've done it a few times. https://xkcd.com/936/ https://xkcd.com/936/

TedDoesntTalk 4y ago

> use oAuth login. This looks like "Sign in with Google", "Sign in with Apple", "Sign in with GitHub", etc. I'm pretty happy using Google's oAuth everywhere No, don’t ever do this. 1. Google or Facebook or Apple now know everywhere you have an account 2. If they choose to disable your access to their service (as happens regularly and without due process), you can’t login to any website.

knaik94 4y ago
I trust Google login and oAuth to be protected with better security practices than the general login. AdSense and other cookies means they probably know where you have an account regardless of if you login. I like that "Sign in with Google" allows me to not make another login and password. For certain sites, after using "Sign in with Google", they have made me make a local account anyway as backup. I don't think a generalization like "don't ever do this" is helpful. I am curious why you say blocked accounts happens regularly. I have heard of it happening to people, but not often.
- TedDoesntTalk 4y ago
  What will you do if Google decides you’ve broken some terms of service and you lose access to gmail and all other Google resources? You are giving them the power to disable access to non-Google websites. And you’re ok with that? HN is littered with people who’ve experienced Google bans. An article hits the front page about it seemingly monthly (and those are only the ones that get publicized). It happens again and again. You have no recourse. There is no one to call. There is never an explanation. I’m not here to convince you. To each his own. If you dont care about the privacy leaks, then surely you can overlook the risk of losing access to your non-Google accounts whenever Google decides.
  - deleted 4y ago
    [deleted]
  - Arainach 4y ago
    Then I create an account with my new email. Sure, for the few sites I care deeply about a long history with, a unique account might be worth it. Those sites are few and far between. My password manager has more than 500 entries. A huge majority are sites I used once and never again. I don't want an account there but was probably required to create one to check out. If Google deleted them they'd be doing me a favor. Google knows I went to those sites anyway since I probably found them through search results.

cybrexalpha 4y ago

Good list, but I think it actually understates the advantage of security keys over other methods of 2FA. It's not just that they're physical objects, it's the protocol (either FIDO U2F or FIDO2/Webauthn) is fundamentally resistant to phishing attacks. Take the author's example of accidentally logging into accounts.google.com.evil instead of accounts.google.com: If you and/or your password manager are tricked and enter your username and password, all other 2FA methods are vulnerable to an active pishing attack where the attacker site relays the login information to the real site in real time. You enter your TOTP code or hit "yes" on a push notification or whatever, the real site logs you in and passes your session cookie to the attacker and you're hacked. With a security key when you log in the browser tells the key what website you're connecting to and about its TLS certificate. If the security key wasn't registered with it exactly, it won't work. It's almost impossible* to get phished if you use a security key as your 2FA method. * There are few ways. If you're phished during first time setup of the security key, or if the attacker gets a valid TLS cert for their website and impersonates accounts.google.com with a network level attack, or if they manage to get a trusted private CA onto your machine and do the same, or if they can exploit a 0day in the browser or the key to disrupt that communication and lie to the security key about the site's identity. But the bar for these forms of attacks is significantly higher.

jefftk 4y ago
I do think the post covers this? This is specifically why I advocate for security keys over TOTP ("they protect you against fake login pages").

seee-I-Told-you 4y ago

While the list is certainly good precautions which everyone for the most part should be implementing and thinking about, it is not a complete list. Even though the author would say "it was not intended to be" it still kind of promises "these mitigations are enough".. and of course the world isn't black and white. Protecting a company or even a sole personal computer is a time staking challenge with multiple dimensions. It involves implementing processes and routines which you stick to, it involves technical solutions for mitigating threats in different categories and it involves planning, configuration and monitoring. It certainly involves staying well informed on vulnerabilities, present threats and the modus operandi of attackers. That's why we security consultants (on a senior level) are more or less useless unless we are developers ourselves and stack 30 000 + hours in experience. And still, with all this experience and knowledge the work is not a piece of cake at all. You have to be prepared to make exceptions, be pragmatic, a good communicator and a good skilled presenter. You have to be prepared to work uncomfortable hours, holidays, weekends etc.

devdiary 4y ago

Using "password manager for everything" comes with a critical disadvantages of making the pass mgr a single point of failure, increasing attack surface area. Take an example of recent Lastpass breach, I am pretty sure it will lead to hacking almost all services for some Lastpass users. Although Lastpass is saying - don't worry, your passwords are encrypted with your master password and it will take million yrs to crack them. No, it won't take even a month/day to crack master password of many of those users. You're overestimating people's ability to create strong master password and the efforts needed in cracking a password. I'd rather be very specific in suggesting password managers, use them only for non-critical services.

xcdzvyn 4y ago
Hard disagree. The problem with Lastpass being pwned was Lastpass being Lastpass. Put your passwords in a password manager, don't put your passwords on the internet in The Cloud™. > You're overestimating people's ability to create strong master password and the efforts needed in cracking a password. Okay - so we're establishing that many people use insecure passwords. Password managers mitigate this risk completely by generating incredibly secure passwords - however, people may use an insecure master password. > I'd rather be very specific in suggesting password managers, use them only for non-critical services. And your proposed solution is for people to use NO secure passwords, but to use their poor password creation abilities on every site they use. This only leads to people using insecure passwords _everywhere_, rather than in one, local file, which is far less likely to be attacked.
- darkwater 4y ago
  > Put your passwords in a password manager, don't put your passwords on the internet in The Cloud™. Which doesn't work well in a multi-devices landscape as the one we live in for many people (even if not the majority, because the majority probably just owns and uses a smartphone).
  - albuic 4y ago
    It works well for me, you just need to synchronize your password manager's file once in a while. Are you really creating that many accounts ? And you can use anything even cloud providers to easily synchronize the single file. I don't use cloud password managers, history has shown it is too risky.

abhaynayar 4y ago

I think self-pwning by running executables downloaded from torrents/shady websites might be a common way people get hacked. A while back I was talking to a bunch of software developers and even they were not convinced that you can get hacked by running games from torrents. What's worse is people also run that stuff as administrator, and then ask their anti-virus to ignore it.

rl3 4y ago
>A while back I was talking to a bunch of software developers and even they were not convinced that you can get hacked by running games from torrents. Untrusted executable code that's expected to be a modified version of the real thing, making hash-based assurances impossible in most cases. Sounds secure to me. /s It's kind of sad, in the days prior to torrents security used to be reputation-based. Not to mention a dynamic where reversers look at each other's work. Since the advent of torrents and with just the sheer amount of games now, I imagine that's suffered quite a bit. Some forms of DRM are arguably malware in and of themselves, so it's ironic that attempts at bypassing that end up as a vector for serious malware. What worries me is since Steam opened its floodgates, theoretically lesser-known titles could be vectors for malicious code. Or heck, even larger titles. What assurances are there, actually? Trust in the publisher and developer is about it.
- intelVISA 4y ago
  Last I checked a decent amount of games on Steam ship with malware like Denuvo so you're probably right.

kkfx 4y ago

Mh, I found this article really strange: - firstly tie ourself to a service is the best thing to do to get lock-out of something "belonging to us" but not under our control, A TOTAL NO GO. We need to own, in person, not give something to others pockets "because their are safer"; - secondly I do not want to use ANY not-personal password managers and recent attacks prove very well why; - thirdly the most simplest form of being "locked out" is that a service we depend on does not work anymore, the simplest form of protection is NOT depending on third parties. Have your own files, on personal hw, with offline LOCAL copies and a good backup strategy (of course on encrypted storage, but that might prevent a thief access the information NOT ensure the availability of something) is a good lock-out prevention. Having a personal mail infra is hard, but owning a domain name and have a LOCAL mailserver at home that just use someone else service as a replica ensure you have the mails and the domain, being "locked out" means just being offline until you restore, still being able to read your mails and eventually move your domain somewhere else and that's far less harder. Having a personal website instead of using some platform is another nice way, especially if you advertise you have also a ZeroNet and similar P2P systems copy, so even if the website is hosted by some provider your readers know there is a LIVE copy in a P2P distributed system and eventually they even have a local copy.