161–170 of 557 posts
If find this just interesting that just last week my steam account was successfully logged in from Russia (I'm in the UK). Looks like I forgot about Steam to make my passwords stronger.
Dropbox is about the only service I use a memorable password for, as it has my 1Password file in it, which has my Google one-time-auth codes in it. If I lose my phone while on the road, only remembering my Dropbox password is going to get me out of the mess. Any sensible other solutions here? It's still ~14 characters, but other than making it more random, what are my options?
All of my passwords are based on the website name that I'm logging in to. I have a small algorithm in my head about how to generate a password from the site name that looks at stuff like first and last letter, number of letters, some kind of prefix/suffix, etc. And I end up with a unique password around 20 characters that I don't need to remember for every website. This way I don't ever remember a password, I just re…
Earlier quoted context omitted.
> some 2FA do not seem to think it is critical to send the email or txt msg right away, and even when they do, email servers do not really work real time SMS isn't real time either, it's best effort. Mostly (~99,9%) it gets through within seconds, but delays of a few minutes are perfectly acceptable to telcos. As service provider you can't do much about it, either pay through the nose for "priority" delivery (which m…
As a service provider there is something you can do about it: Use well known out-of-band 2FA specs such as TOTP. Those are compatible with Google Authenticator and don't require a phone number, which is a massive inconvenience (not always available, not available in every country, SMS not reliable, requires an ID, not free, leaks personal information to the service provider, ...)
Earlier quoted context omitted.
> Credit cards should work the same way: a unique authorization code specific to this vendor or this transaction and useless to any other actor. Isn't that how chip-and-pin works?
Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.
I have no idea what Paypal is trying to achieve by passing on this fairly personal piece of data. I always have to enter a separate email address with the retailer anyway, and because of this scheme, those two of course never match.
If find this just interesting that just last week my steam account was successfully logged in from Russia (I'm in the UK). Looks like I forgot about Steam to make my passwords stronger.
I turn on 2FA wherever I can now. If only steam supported modern 2FA and not sending a code via email.
It was pretty obvious the dropbox hack was real several years ago, because lots of spam mail started arriving at my dropbox-unique email almost immediately after the breach. I changed my email to another unique address quickly back then. Unique-per-service email addresses work pretty well as a canary for breaches. Just make sure there is more uniqueness than just the service name to such addresses, or someone could s…
unique-per-service email addresses sound indeed interesting. How did you set it up? I am a google apps customer and already have a few 20 aliases in there but having to go through their UI every time I sign up seems very tiresome. Can I create a wildcard email in the terms of service-*@bar.com being a alias of email foo@bar.com? Do you know of a non-selfhosted provider that is able to do that? /EDIT: Looks like fastm…
This works better than something+realaddress@gmail.com because many sites fail to handle/allow that 'format'.
Earlier quoted context omitted.
Except that the merchant still gets to see my credit card numbers (both sides). But it's how paypal works. The merchant only get an authorization code from paypal, and this code is useless to a hacker.
> the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.
Something to keep in mind is that when chip and PIN was developed to combat credit card fraud it was card present fraud that was the big problem, either by someone using the stolen card itself at a brick and mortar merchant or making a counterfeit cart by writing the stolen number onto a blank card and using that at a brick and mortar merchant. Card not present fraud, where the number is used but not a card such as at an online merchant or a mail order merchant or telephone order merchant, was much less common.
Chip and pin made card present fraud much harder because it was much harder to obtain blank chip cards and the equipment to write a stolen number to them, and it made using an actual stolen card harder because of the PIN.
Earlier quoted context omitted.
Wow, single point of failure for all my accounts, all my credential, all my personal, private and public data. I would love to use it!
I know you're being sarcastic, but with lastpass you can rotate most of your passwords. https://blog.lastpass.com/2014/12/introducing-auto-password-...
Earlier quoted context omitted.
It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, prov…
> Resilio Sync (formerly Bittorrent Sync) Good job they changed their name. Couldn't get the product adopted in a corporate environment because of all the cries of "Witch! Witch!" when the suits saw the word Bittorrent in there.
Earlier quoted context omitted.
> the merchant still gets to see my credit card numbers (both sides) With chip and pin? I don't think they do.
In the UK the numbers are printed on the receipt - part obfuscated on the customers copy, fully shown on retailer copy. So whilst the retailer may not touch the card they still get everything except the magic 3 digits. Where I work you need the 3 digit security code and some address numbers (which you can make up) to properly process a transaction without the card.