4 ms·

Ugh I have a smattering of accounts that use the same password before I wised up and started using a generator. My important accounts are secure by 2fa however

Ugh I have a smattering of accounts that use the same password before I wised up and started using a generator. My important accounts are secure by 2fa however and a strong password. One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up.

diggan 3y ago
> One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up. Maybe do it while being connected to a network that isn't infamous for its poor security :)
- CoastalCoder 3y ago
  I'm not super educated on security stuff, but would airplane wifi add any significant risk? I'd think that as long as your laptop isn't already compromised, and you don't need to use someone's proxy server, HTTPS would be secure enough. I.e., no worse than doing it from home.
  - r1ch 3y ago
    The biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can intercept or snoop on that traffic. Browsers generally do a good job of ensuring HTTPS these days, but still you should pay attention to make sure you're on HTTPS when using public Wi-Fi.
- andreareina 3y ago
  HTTPS fixes that
djbusby 3y ago
My password tool shows me which are oldest. So, quarterly (on tax day) I also make sure to change a few of them.
- avidiax 3y ago
  What's the theory? Nobody is spending a year to crack your passwords or use a leaked password, so either they are strong enough to resist online or offline attacks, or they aren't. If they aren't strong enough, then you would have to rotate much more often than every few years.
  - stcredzero 3y ago
    Nobody is spending a year to crack your passwords or use a leaked password How strong is that nowadays? How many bits of entropy?
  - notwhereyouare 3y ago
    they may not, but if there is a password dump, you password isn't super old and has been rotated fairly recently
  - djbusby 3y ago
    Theory is that I'll rotate out passwords insecure? systems. One case I know is that in one system my old password was hashed with an older method (which was the right choice at the time) and when I reset I'm now using their updated (right choice today) hash. Another feature is that services I don't use I'm reminded to close/deactivate.
  - rantallion 3y ago
    Assuming we start from the position of having a unique, never-before-seen password for each account (which is what we should all be doing, right?), rotating doesn't do anything. And if we accept that most people don't use unique, never-before-seen passwords and that a password has been included in a plaintext dump, rotating passwords periodically doesn't even protect from password spray attacks, since someone has likely used that password before and you'll still be vulnerable.
stcredzero 3y ago
One day I'll sit down and just go through them all to fix them. I had a spate of going through and putting in 2FA on everything 1Password indicated could have it. Then, I had another spate of changing all my passwords on accounts I still had in my defunct LastPass. (I switched from LastPass to 1Password before the big breach.)
- Glant 3y ago
  You should try going through the list and deleting accounts you never use anymore. That one's always fun because many companies try to hide the delete account button or simply don't have one
  - Symbiote 3y ago
    There are services that do this by using GDPR rights. I think they scan email for "Welcome" emails, then automate the account deletion as far as possible. We get about 5 emails a year at work through these services, as we don't have a "delete account" button.
Arrath 3y ago
> One day I'll sit down and just go through them all to fix them. I like to tell this to myself every time I log onto my online banking using the 'Temporary <credit union name>' entry in bitwarden. One day.

diggan 3y ago

> One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up. Maybe do it while being connected to a network that isn't infamous for its poor security :)

CoastalCoder 3y ago
I'm not super educated on security stuff, but would airplane wifi add any significant risk? I'd think that as long as your laptop isn't already compromised, and you don't need to use someone's proxy server, HTTPS would be secure enough. I.e., no worse than doing it from home.
- r1ch 3y ago
  The biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can intercept or snoop on that traffic. Browsers generally do a good job of ensuring HTTPS these days, but still you should pay attention to make sure you're on HTTPS when using public Wi-Fi.
andreareina 3y ago
HTTPS fixes that

djbusby 3y ago

My password tool shows me which are oldest. So, quarterly (on tax day) I also make sure to change a few of them.

avidiax 3y ago
What's the theory? Nobody is spending a year to crack your passwords or use a leaked password, so either they are strong enough to resist online or offline attacks, or they aren't. If they aren't strong enough, then you would have to rotate much more often than every few years.
- stcredzero 3y ago
  Nobody is spending a year to crack your passwords or use a leaked password How strong is that nowadays? How many bits of entropy?
- notwhereyouare 3y ago
  they may not, but if there is a password dump, you password isn't super old and has been rotated fairly recently
- djbusby 3y ago
  Theory is that I'll rotate out passwords insecure? systems. One case I know is that in one system my old password was hashed with an older method (which was the right choice at the time) and when I reset I'm now using their updated (right choice today) hash. Another feature is that services I don't use I'm reminded to close/deactivate.
- rantallion 3y ago
  Assuming we start from the position of having a unique, never-before-seen password for each account (which is what we should all be doing, right?), rotating doesn't do anything. And if we accept that most people don't use unique, never-before-seen passwords and that a password has been included in a plaintext dump, rotating passwords periodically doesn't even protect from password spray attacks, since someone has likely used that password before and you'll still be vulnerable.

stcredzero 3y ago

One day I'll sit down and just go through them all to fix them. I had a spate of going through and putting in 2FA on everything 1Password indicated could have it. Then, I had another spate of changing all my passwords on accounts I still had in my defunct LastPass. (I switched from LastPass to 1Password before the big breach.)

Glant 3y ago
You should try going through the list and deleting accounts you never use anymore. That one's always fun because many companies try to hide the delete account button or simply don't have one
- Symbiote 3y ago
  There are services that do this by using GDPR rights. I think they scan email for "Welcome" emails, then automate the account deletion as far as possible. We get about 5 emails a year at work through these services, as we don't have a "delete account" button.

Arrath 3y ago

> One day I'll sit down and just go through them all to fix them. I like to tell this to myself every time I log onto my online banking using the 'Temporary <credit union name>' entry in bitwarden. One day.