4 ms·

You're gonna get pwned, and you're gonna get pwned hard. Brace for it because it's coming sooner or later. It's convenient until you lose all of your passwords.

by nusl 3y ago

nottorp 3y ago
> Brace for it because it's coming sooner or later. I wonder if it will be his passwords, or one of the providers of those impenetrable password replacement keys will be breached first, in a way that leaks everything.
- nusl 3y ago
  Unsure though the OP’s laptop being stolen or a rogue program stealing their passwords.txt is a lot more likely. The providers being attacked will still require the keys themselves to be attacked since they hold the secrets.
trey-jones 3y ago
The point still needs to be made. I always present security as a sliding scale with secure on one side and convenient on the other. Similar to low-cost and convenient streaming services reducing piracy, and then seeing the return of piracy as they become higher cost and less-convenient, any application needs to consider not only how to protect its users and their data, but also how to not drive away users with security measures that encroach into that inconvenient zone. 2FA can definitely approach that zone in a few different ways eg. having to reauthenticate too often, or especially for technical users in situations where account sharing is a reality that isn't going away anytime soon: by not making your secret tokens readily available. It has been evident for years that Twilio was just trying to force vendor lock-in and I've always hated Authy. The desktop app at least gave you some agency (secrets on a device that you own and fully control), but I guess that was too much too ask in the long term. Aside: there are measures that increase security without affecting convenience (much). Take those first. Additional Aside to the text file password cowboy: since moving into password managers (first lastpass, now bitwarden) I've found it to be more convenient (usually) and I have a lot more peace of mind about it. Maybe try it?
- nusl 3y ago
  2FA definitely will protect you even if your passwords.txt is stolen, probably. I can’t imagine that trying to manage syncing and easy access to the passwords.txt is even remotely as secure or easy as something like 1Password. Services, IMO, have a duty to do their utmost in protecting customer security and privacy. Fortunately Passkeys are becoming more common and I’m hoping more folks will choose them since they’re way better than plain passwords. The problem with choosing convenience now is that you don’t know what the future holds, and a good chunk of security is stuff that people don’t know becoming known, sometimes very publicly so. Eg a new 0day in Firefox is found, exploited, and the passwords.txt is gone before the user patches it (admittedly likely since I am unsure if the OP is up for the inconvenience of frequent browser or critical software updates). If you’ve ever had anything important of yours being hacked you’ll probably understand how shitty it is and how it’s worth the inconvenience. Modern password managers are very convenient though. I love not knowing a single one of my service passwords. Plus, my laptop being stolen is probably gonna still protect my passwords since 1Password does protect them at rest, pending brute-forcing the (very long) master password. None of this is true or exists for a plaintext file. Even then, say OP doesn’t care about getting hacked and someone gets into their email. Now, the hacker has their email and contact lists. They can use that info to target OP’s contacts with more-viable phishing or other attacks.
Dalewyn 3y ago
I can count the passwords truly critical to my livelihood on one hand (and those are unique). I couldn't care less about everything else (and they all more or less share the same or similar passwords), pwn away.
- nusl 3y ago
  That’s the same for me. That being said, I don’t current me enough to make good security decisions for future me based on current knowledge, so I do what I can now instead. The overhead is extremely minimal if you use a password manager.

You're gonna get pwned, and you're gonna get pwned hard. Brace for it because it's coming sooner or later. It's convenient until you lose all of your passwords.

by nusl 3y ago

You're gonna get pwned, and you're gonna get pwned hard. Brace for it because it's coming sooner or later. It's convenient until you lose all of your passwords.

nottorp 3y ago

> Brace for it because it's coming sooner or later. I wonder if it will be his passwords, or one of the providers of those impenetrable password replacement keys will be breached first, in a way that leaks everything.

nusl 3y ago
Unsure though the OP’s laptop being stolen or a rogue program stealing their passwords.txt is a lot more likely. The providers being attacked will still require the keys themselves to be attacked since they hold the secrets.

trey-jones 3y ago

The point still needs to be made. I always present security as a sliding scale with secure on one side and convenient on the other. Similar to low-cost and convenient streaming services reducing piracy, and then seeing the return of piracy as they become higher cost and less-convenient, any application needs to consider not only how to protect its users and their data, but also how to not drive away users with security measures that encroach into that inconvenient zone. 2FA can definitely approach that zone in a few different ways eg. having to reauthenticate too often, or especially for technical users in situations where account sharing is a reality that isn't going away anytime soon: by not making your secret tokens readily available. It has been evident for years that Twilio was just trying to force vendor lock-in and I've always hated Authy. The desktop app at least gave you some agency (secrets on a device that you own and fully control), but I guess that was too much too ask in the long term. Aside: there are measures that increase security without affecting convenience (much). Take those first. Additional Aside to the text file password cowboy: since moving into password managers (first lastpass, now bitwarden) I've found it to be more convenient (usually) and I have a lot more peace of mind about it. Maybe try it?

nusl 3y ago
2FA definitely will protect you even if your passwords.txt is stolen, probably. I can’t imagine that trying to manage syncing and easy access to the passwords.txt is even remotely as secure or easy as something like 1Password. Services, IMO, have a duty to do their utmost in protecting customer security and privacy. Fortunately Passkeys are becoming more common and I’m hoping more folks will choose them since they’re way better than plain passwords. The problem with choosing convenience now is that you don’t know what the future holds, and a good chunk of security is stuff that people don’t know becoming known, sometimes very publicly so. Eg a new 0day in Firefox is found, exploited, and the passwords.txt is gone before the user patches it (admittedly likely since I am unsure if the OP is up for the inconvenience of frequent browser or critical software updates). If you’ve ever had anything important of yours being hacked you’ll probably understand how shitty it is and how it’s worth the inconvenience. Modern password managers are very convenient though. I love not knowing a single one of my service passwords. Plus, my laptop being stolen is probably gonna still protect my passwords since 1Password does protect them at rest, pending brute-forcing the (very long) master password. None of this is true or exists for a plaintext file. Even then, say OP doesn’t care about getting hacked and someone gets into their email. Now, the hacker has their email and contact lists. They can use that info to target OP’s contacts with more-viable phishing or other attacks.

Dalewyn 3y ago

I can count the passwords truly critical to my livelihood on one hand (and those are unique). I couldn't care less about everything else (and they all more or less share the same or similar passwords), pwn away.

nusl 3y ago
That’s the same for me. That being said, I don’t current me enough to make good security decisions for future me based on current knowledge, so I do what I can now instead. The overhead is extremely minimal if you use a password manager.