4 ms·

> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can br

> I never spell it out, let alone write it down, but it is in my muscle memory as I haven't changed it for years. There is no way someone on the internet can break into my ssh account or gmail account protected by such a password. Oh dear. The issue isn’t the brute force, it’s that the online services leak and get cracked. And in an instant a single script takes the newly discovered username password combo and starts hammering it into the top 10000 websites, all within moments of the leak data becoming available. Your super secret favourite phrase is worth crap once leaked alongside your email address. Further don’t choose Microsoft for your Auth app, Go with an open source option, maybe one that encrypts and syncs so you have multiple devices just in case.

ajd555 2y ago
I could not agree more with this comment. OP entirely misses the point of 2FA. I sleep so much better at night knowing that I have different passwords for every account, and 2FA where possible. One should not write about 2FA when one uses the same "uncrackable" password everywhere...
- autoexec 2y ago
  Maybe I missed it (it's early and I haven't even had coffee yet) but where did the author say they resued the same password over multiple sites?
femtozer 2y ago
Not sure I understand — passwords are generally hashed in databases. Even if leaked, an attacker would still need to brute-force the hash to retrieve the actual password, wouldn’t they?
- evolve2k 2y ago
  You’d think so. But over and over plain text leaks of passwords is the practical reality of the modern internet. A disgruntled staff member, poor tech practices or someone working out a way to get in and get access. The https://haveibeenpwned.com/ https://haveibeenpwned.com/ project regularly shares new breached datasets. Reusing passwords across websites without MFA is just not not not recommended in 2025.
- parliament32 2y ago
  "Generally", sure. How do you guarantee every service you've ever signed up for uses proper salting and hashing though? All it takes is one for your entire security model to go down the drain.
deleted 2y ago
[deleted]
autoexec 2y ago
> Oh dear. The issue isn’t the brute force, it’s that the online services leak and get cracked. And in an instant a single script takes the newly discovered username password combo and starts hammering it into the top 10000 websites, all within moments of the leak data becoming available. This is only ever a problem if your password is reused. Don't reuse passwords and if some website is hacked and they were storing your password in plaintext you just have to reset your password (the same way everyone else does, 2FA or not)
- c22 2y ago
  Also don't re-use email addresses.
- robertlagrant 2y ago
  > This is only ever a problem if your password is reused That is the context of the reply, although I think they misread the article.
- evolve2k 2y ago
  The larger problem is when your password gets hacked for whatever reason that the MFA protects your account. Anyone else here had friends have their say Instagram account hacked, none ever have MFA on and it causes great distress. MFA IS a good idea for multiple reasons.
  - sam_lowry_ 2y ago
    MFA is bad idea for as many reasons if not more: complexity of implementation, variety, digital sovereignty... to name a few.
Justsignedup 2y ago
the weird thing is: - if you use 1password (an example), then you're generating a bunch of random and unique passwords for every site - questions to verify you as a 2fa tends to be less secure since you tend to make simple answers for those. And they're not convenient to enter into 2fa apps. - 2fa apps are typically great ways to guarantee one bit of randomness into the process
- tracker1 2y ago
  I use the same app for most 2fa and the passwords themselves (Bitwarden). It makes the 2FA slightly weaker being in the same app, but infinitely more useful. It does bug me that they (Bitwarden) as a service want me to use 2FA for first logins, which makes it harder to access. My master passphrase is long, unique and only on their app/site.
  - sam_lowry_ 2y ago
    Master password that you share with a third party? I probably do not understand how Bitwarden works, but this feels wrong anyway.
    - tracker1 2y ago
      If trust issues and paranoia are sufficient, you can definitely self-host the server portion of the application, and many do. ;-) Bitwarden is open-source enough to where all functionality can be self-hosted and run on one's own and reviewed. IIRC, there are a couple of non-floss modules for the commercial release in different directories under source control iirc... Some are more purist than others.
tracker1 2y ago
While true... this is less of an issue if the breached database includes strongly encrypted passwords with individual salts. At least half of them are going to be part of existing breaches, but you aren't going to bother with the rest as it can/will take an exponential amount of time if they are treated properly, leaving top's password safe(ish).
- tomjakubowski 2y ago
  Passwords can leak in many ways other than database breaches. Malicious front-end code and accidental logging that goes to a public place like an S3 bucket are two examples.
- 9dev 2y ago
  So I am supposed to trust that the random forum I have to sign up for to view the solution of a question securely hashes the password I send them? That’s pretty much like handing you car keys to a random person on the street and be confident they will take it to the bank and put it in a locker.
  - guappa 2y ago
    Why do you care? It's not like you use the same password for everything right?
    - 9dev 2y ago
      I don’t, but the people we try collectively to protect do. That’s why we have 2FA and Passkeys in the first place, because most people will not conform to security best practices
- saghm 2y ago
  It's also less of an issue if the passwords never get leaked at all. The question is how much of a bet you're willing to make on the security practices of all of the sites where you have an account following this practice, and at least to me it doesn't seem like a smart.

ajd555 2y ago

I could not agree more with this comment. OP entirely misses the point of 2FA. I sleep so much better at night knowing that I have different passwords for every account, and 2FA where possible. One should not write about 2FA when one uses the same "uncrackable" password everywhere...

autoexec 2y ago
Maybe I missed it (it's early and I haven't even had coffee yet) but where did the author say they resued the same password over multiple sites?

femtozer 2y ago

Not sure I understand — passwords are generally hashed in databases. Even if leaked, an attacker would still need to brute-force the hash to retrieve the actual password, wouldn’t they?

evolve2k 2y ago
You’d think so. But over and over plain text leaks of passwords is the practical reality of the modern internet. A disgruntled staff member, poor tech practices or someone working out a way to get in and get access. The https://haveibeenpwned.com/ https://haveibeenpwned.com/ project regularly shares new breached datasets. Reusing passwords across websites without MFA is just not not not recommended in 2025.
parliament32 2y ago
"Generally", sure. How do you guarantee every service you've ever signed up for uses proper salting and hashing though? All it takes is one for your entire security model to go down the drain.

deleted 2y ago

[deleted]

autoexec 2y ago

> Oh dear. The issue isn’t the brute force, it’s that the online services leak and get cracked. And in an instant a single script takes the newly discovered username password combo and starts hammering it into the top 10000 websites, all within moments of the leak data becoming available. This is only ever a problem if your password is reused. Don't reuse passwords and if some website is hacked and they were storing your password in plaintext you just have to reset your password (the same way everyone else does, 2FA or not)

c22 2y ago
Also don't re-use email addresses.
robertlagrant 2y ago
> This is only ever a problem if your password is reused That is the context of the reply, although I think they misread the article.
evolve2k 2y ago
The larger problem is when your password gets hacked for whatever reason that the MFA protects your account. Anyone else here had friends have their say Instagram account hacked, none ever have MFA on and it causes great distress. MFA IS a good idea for multiple reasons.
- sam_lowry_ 2y ago
  MFA is bad idea for as many reasons if not more: complexity of implementation, variety, digital sovereignty... to name a few.

Justsignedup 2y ago

the weird thing is: - if you use 1password (an example), then you're generating a bunch of random and unique passwords for every site - questions to verify you as a 2fa tends to be less secure since you tend to make simple answers for those. And they're not convenient to enter into 2fa apps. - 2fa apps are typically great ways to guarantee one bit of randomness into the process

tracker1 2y ago
I use the same app for most 2fa and the passwords themselves (Bitwarden). It makes the 2FA slightly weaker being in the same app, but infinitely more useful. It does bug me that they (Bitwarden) as a service want me to use 2FA for first logins, which makes it harder to access. My master passphrase is long, unique and only on their app/site.
- sam_lowry_ 2y ago
  Master password that you share with a third party? I probably do not understand how Bitwarden works, but this feels wrong anyway.
  - tracker1 2y ago
    If trust issues and paranoia are sufficient, you can definitely self-host the server portion of the application, and many do. ;-) Bitwarden is open-source enough to where all functionality can be self-hosted and run on one's own and reviewed. IIRC, there are a couple of non-floss modules for the commercial release in different directories under source control iirc... Some are more purist than others.

tracker1 2y ago

While true... this is less of an issue if the breached database includes strongly encrypted passwords with individual salts. At least half of them are going to be part of existing breaches, but you aren't going to bother with the rest as it can/will take an exponential amount of time if they are treated properly, leaving top's password safe(ish).

tomjakubowski 2y ago
Passwords can leak in many ways other than database breaches. Malicious front-end code and accidental logging that goes to a public place like an S3 bucket are two examples.
9dev 2y ago
So I am supposed to trust that the random forum I have to sign up for to view the solution of a question securely hashes the password I send them? That’s pretty much like handing you car keys to a random person on the street and be confident they will take it to the bank and put it in a locker.
- guappa 2y ago
  Why do you care? It's not like you use the same password for everything right?
  - 9dev 2y ago
    I don’t, but the people we try collectively to protect do. That’s why we have 2FA and Passkeys in the first place, because most people will not conform to security best practices
saghm 2y ago
It's also less of an issue if the passwords never get leaked at all. The question is how much of a bet you're willing to make on the security practices of all of the sites where you have an account following this practice, and at least to me it doesn't seem like a smart.