3 ms·
If your setup includes a password manager, generated unique passwords and enabling 2FA everywhere you can, there's not much else to do. Just use a unique compl
by vntok 1y ago
If your setup includes a password manager, generated unique passwords and enabling 2FA everywhere you can, there's not much else to do.
Just use a unique complex root password for your password manager and check semi-regularly that it hasn't leaked on haveibeenpwnd.
Bonus points if your password manager automatically checks your stored passwords for leaks and scores them (eg. LastPass)
- jxjnskkzxxhx 1y agoI happen to think that having your password manager online is a mistake.
- mdaniel 1y agoFor your consideration, one does not need to have their password manager online to use HIBP; they offer [at least] two different concessions to your concerns: - SHA1 or NTLM hash prefix matching https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByR... - actually download the HIBP db and check for yourself https://haveibeenpwned.com/API/v3#PwnedPasswordsDownload https://haveibeenpwned.com/API/v3#PwnedPasswordsDownload Thus you could hash your passwords in your airgapped setup, transfer the hashes using a mechanism you trust to an Internet connected device, and then check the hashes