As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I use the free version of Maskme or Blur from Abine https://www.abine.com/index.html
GoToMyPC has been hacked, all customer passwords reset
41–50 of 171 posts
Re: GoToMyPC has been hacked, all customer passwords reset
#42Earlier quoted context omitted.
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.
If a lot of people start doing this thing, then it will be trivial for an attacker to figure out name+service1@domain can be changed to name+service2@domain
Re: GoToMyPC has been hacked, all customer passwords reset
#43Why do people keep recommending these incredibly insecure passwords... replacing vowels with numbers will do little... Ugh
Such recommendations leave little to imagination when they say:
... service has been targeted by a very sophisticated password attackRe: GoToMyPC has been hacked, all customer passwords reset
#44As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
I use https://www.passwordstore.org/ to generate passwords which are then encrypted using my GPG keys. My passwords directory is a git repo which I sync to GitHub. Since I don't possess a Yubikey or similar, I've stored a copy of my secret key in Protonmail.
Re: GoToMyPC has been hacked, all customer passwords reset
#45As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
> I use https://lastpass.com/ for generating passwords. ... Would prefer open source, but nothing else comes close.
On a linux/unix system, one could use /dev/urandom:
tr -dc '[[:alnum:][:punct:]]' One could even put the following function in $HOME/.bash_profile or such
genpw() {
tr -dc '[[:alnum:][:punct:]]' Re: GoToMyPC has been hacked, all customer passwords reset
#46As these hacks are becoming more common place, I'd love to hear fellow HN reader's take on their password strategy/management. Many thanks in advance!
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
KeePassX (https://www.keepassx.org/) is free and open source password manager. Having never tried LastPass I can't vouch that it's feature compatible, but it covers all my needs.
Re: GoToMyPC has been hacked, all customer passwords reset
#47Earlier quoted context omitted.
A unique password, 2FA, AND a unique email address. I use https://lastpass.com/ for generating passwords. $12/year and works on Linux & Android. Would prefer open source, but nothing else comes close. I tend to generate 32 char passwords with a mix of upper, lower, number, and special. Only a few websites insist on shorter passwords - or have character restrictions. For 2FA I use either SMS or Authy https://www.authy…
Good idea on (2). I have a gmail account, so I just use myaccount+whatever_service@gmail.com. Pretty handy.
How do you generate new emails? Say, I see a new websites I need a new email? What do you do? Is there a chrome extension that can do it with one click?
Re: GoToMyPC has been hacked, all customer passwords reset
#48They don't really say it has been hacked, just that being a target of an advanced password attack.
It might mean attackers are using password lists from previous leaks (linkedin), so they decided to force a pass reset to everyone. Or maybe they got hacked. Who knows, not very clear.
Re: GoToMyPC has been hacked, all customer passwords reset
#49This is not a good suggestion on their part, and has long been proven ineffective:
Substitute numbers for letters that
look similar (for example, substitute
“0” for “o” or “3” for “E”.Re: GoToMyPC has been hacked, all customer passwords reset
#50Gee, we have to wonder if some good anomaly detection
https://news.ycombinator.com/item?id=11880593
would have detected that intrusion?