Discuss Password Managers 2019

[upnorth]

I have 2FA even on my old throw away yahoo account. Someone finally tried to access it and I got an alert and denied it. Never seen it in action before other than authenticating a session I initiated, pretty useful.

Was it caught and shared in some hack, that you know of?

https://haveibeenpwned.com/

 

[blackice]

Was it caught and shared in some hack, that you know of?

https://haveibeenpwned.com/

Yes it’s been part of multiple hacks. It’s actually a straight authenticated account. They just put in my email and attempted to login. The Authenticator asked if it was me. I had changed the password multiple times since the hacks. Then they switched their Authenticator to being password free, which I forgot about. I regularly run my emails and my wife’s emails through haveibeenpwned. Thankfully we’ve had few to deal with.

 

[upnorth]

Great example that it actually is possible to protect oneself, even in a event of a hack. Thanks @blackice

 

[Threadripper]

If you're hacked you're done, they take all the passwords from your local machine when you decrypt them with your master password - not from the remote server. To mitigate this

1) never store your 2FA codes for your accounts on the same password manager you use for your passwords (I'd go as far as don't use the same machine, to maximally decouple the 2nd factor from your passwords)
2) take measures to secure the machine to avoid compromise
3) don't sweat over it, if they only have the passwords without the 2FA codes for your logins nothing can happen and if you use a good security product this should not happen in the first place.

You said if they are hacked which is why I was talking about password managers, you're talking about using your password manager on a compromised device - obviously that's going to be a problem.

 

[notabot]

You said if they are hacked which is why I was talking about password managers, you're talking about using your password manager on a compromised device - obviously that's going to be a problem.

If you keep 2nd factors on a separate device, ie use PC for passwords, mobile for 2FA -- even then I don't think it's a total disaster.

 

[LDogg]

brain.exe is too busy and uses more resources on businesses than remembering passwords for 300 websites...

That's if you're not visiting 300 websites that you need to login to

Plus my memories amazing.

~LDogg