c/cybersecurity-tips

My password manager just nuked 14 saved logins on update

Updated it Sunday morning and when I opened it later, 14 passwords for banking and email were just gone, no sync conflict or anything. I had to reset everything with password hints and phone calls, has anyone else had their vault wipe after a routine update?

Two-factor fatigue is real, but I still tell people to keep it on

Last week I was helping my aunt with her email after she got locked out of her bank app, and she said the whole two-factor thing is just too much. I get it, waiting for that code every single time is annoying. But I watched her get her account drained in 2018 because she reused a password, and that was way worse than 15 extra seconds. She kept her phone in her purse, never clicked sketchy links, but that didn't matter when her password showed up in a breach list. I think we push convenience too hard in these tips threads and forget that the annoying step is usually the one saving us. She still grumbles, but she turned it back on when I showed her the fraud alert from that old breach. Has anyone else had to talk a family member into keeping 2FA after a lockout scare, or am I the only one playing tech support on Thanksgiving?

Finally switched to hardware key after my Google account got hit in June

I had a choice between a YubiKey and just sticking with SMS codes. Picked the YubiKey 5 NFC after my account got phished near Seattle. Setup took under 20 minutes but I still keep a backup code in my wallet. Anyone else make the jump after a scare or did you go with a different brand?

Two-step verification got me locked out of my own email last month

I set up an authenticator app on my new phone back in September, but never removed the old one from my account. When the backup codes expired and my carrier swapped the SIM, I spent four hours on hold at the Verizon store in Reno before they could verify my identity. Has anyone else had this backward where the security measure causes the breach of access?

I finally had a perfect day with my password manager after months of fighting it

Last Tuesday everything just clicked. I was logging into my bank, email, and work VPN all within like 2 minutes and nothing timed out or rejected my autofill. Usually I spend 10 minutes re-syncing my vault or typing things manually because the browser extension glitches. Has anyone else had one of those rare days where all your security tools actually cooperate?

Paid $30 for a password manager last year and it saved my bank account

I got phished on a fake Amazon login page and my password manager didn't autofill, which tipped me off before I hit submit. Anyone else have a near miss saved by a tool like that?

Took me 4 hours to find a single open port on my router because the UI was hiding it behind a 'more settings' button

The manual said it was under 'port forwarding' but it was actually labeled 'virtual server' with zero explanation. Has anyone else wasted an afternoon hunting down a feature that was just renamed for no reason?

PSA: A coworker convinced me to stop using the same password for everything after a breach

I used to use the same simple password for my email, bank, and social media because it was easy to remember. Then a coworker showed me her Have I Been Pwned report last month and she had 12 accounts compromised from one leaked password. I figured the odds were low for me, but she pulled up my own email and showed I had 3 breaches I never knew about. That scared me enough to finally set up a password manager and use unique passwords. It took me about an hour to change 20 accounts, but I feel way safer now. Has anyone else had a wake-up call like this from a specific person?

Is it worse to have a weak password or to reuse one across everything? A coworker at the office last week told me he uses the same password for his banking, email, and Netflix because he's afraid of forgetting them.

I tried to explain password managers to him but he said they're too complicated. I get the fear of forgetting stuff but man, if one site gets breached he's cooked. On the other hand, a super simple password that's unique for each site is still weak. Which do you think is the bigger risk day to day?

Hit 100 days with ZERO phishing clicks from my team today

I started a dumb little calendar contest at our office back in March, and we just crossed 100 days without anyone falling for a test phishing email. What weird tricks have you guys used to get coworkers to actually care about security?

A pentester told me my password manager setup was useless

I had been using a free password manager for about 2 years and thought I was being safe. Then a buddy who does penetration testing looked at my setup and said storing my master password in a notes app on my phone defeats the whole point. He showed me how easy it is for malware to scrape that data. I switched to a hardware key like a YubiKey for 2FA on my vault last month. Now I also keep a backup paper copy in my fire safe at home. Has anyone else had a security pro call out a blind spot like this in your routine?

Met a guy at Defcon who swore password managers were a trap

I was at a small talk after-party in Vegas, and this old-school sysadmin told me he refuses to use any password manager. He said he keeps everything in a paper notebook he stores in a fire safe, and claims he's never been hacked in 25 years. I tried to argue that a password manager with 2FA is safer, but he pointed out that his method can't be phished or data-breach leaked. Kinda made me rethink the whole "cloud everything" mindset. Anyone else know folks who stick to analog security like that?

Overheard a guy at the coffee shop say his password was 'password123' and I had to say something

I was grabbing a latte at this little spot on Grand Ave yesterday and this dude is on his laptop, telling his friend his password is 'password123' for everything. He laughed about it too. I leaned over and told him to change it because I've had people get into my old email from a breach and it cost me $400 in fake charges. Has anyone else run into people just not caring about passwords until they get burned?

That Tuesday my CEO clicked a phishing link and took down our whole network

I work IT for a 50 person company in Austin and last month someone sent a fake DocuSign email to the whole company. Our CEO clicked it and within 2 hours ransomware encrypted our file server and 12 workstations. How do you get executives to actually take security training seriously without getting yourself fired?

Hot take: Password managers are great but browser saved passwords still have a place

Okay so I used to be team "just let Chrome save everything" for like 5 years (I know, I know). Then about 18 months ago my buddy caught me logging into my bank on his laptop and saw Chrome autofill my password and he freaked out. He set me up with Bitwarden that same night and I was all in for a while. But now I'm wondering if maybe browsers aren't as terrible as everyone says? Like the convenience factor is real and most attacks on saved passwords need physical access to your device anyway. But then again a data breach on your browser sync could expose everything at once. I keep going back and forth on this. Anybody else find themselves using both systems for different accounts? What's your line where you say "okay that one goes in the manager" vs "yeah the browser can handle this"?

Remember when we all used the same password for everything?

I think back to 2014 when I had one password for like 15 accounts, including my bank. Now I'm using a password manager with 40 different passwords and it's a pain but at least I haven't been hacked since. Anyone else miss the old simplicity or is the hassle worth it?

That one time I fell for a fake password reset email at work

I was at my desk last Tuesday and got an email that looked exactly like our IT department asking me to reset my password through a link. I clicked it and typed in my credentials before realizing the URL was off by one letter. Anyone else ever almost get caught by a phishing email that looked totally legit?

Hot take: password rotation rules are making things worse

I work IT for a mid-sized company in Austin and last quarter alone I reset 40 accounts because people wrote their new passwords on sticky notes under their keyboards. When I asked why, they said they couldn't remember a fresh 12-character string every 90 days. Has anyone else seen this backfire in their own workplace?

Password manager vs memory debate after my notebook got stolen

I kept my passwords in a little notebook for 3 years because I didn't trust cloud storage. Last week someone swiped my bag at a coffee shop in Portland and that notebook was in it. Took me 6 hours to change every account and I'm still finding old logins I forgot about. So which is actually worse - relying on a physical thing that can get lost, or trusting a digital vault that could get hacked? Anyone else ever have their physical backup plan blow up on them?

Question about paying for a password manager - was it worth it for anyone?

I finally caved and paid for a password manager last month after getting locked out of my email for the third time. The cost was $36 for the whole year, which is only $3 a month. I was always using the free version before, but it limited me to just one device. Now I can sync between my phone and laptop, and it autofills everything. It already saved me when I forgot my bank login and it pulled it up in seconds. Has anyone else had good luck with paid password managers or do you stick with free ones?

Overheard a guy at the coffee shop talking about his password manager getting hacked...

Warning: A friend's comment about my password manager setup made me switch everything

My buddy Mark caught me using the same master password for my Bitwarden vault that I used on a random forum from 2018. He pointed out that if that forum got breached, my whole vault was toast. I spent last weekend rotating all 47 of my stored logins and enabling a YubiKey for 2FA. Has anyone else had someone call out a lazy security habit that made you totally rethink your approach?

TIL that password manager I ignored for years saved my butt in 20 minutes

I got a call from my bank last Tuesday saying someone tried to log into my account from a coffee shop in Boise. I don't live anywhere near Idaho. That got me spooked, so I finally sat down and set up Bitwarden on my phone and laptop. It took maybe 20 minutes to replace all my reused passwords with random generated ones. I had been using the same password for like 10 different sites since 2016. Now I can't even remember my Netflix password, but I don't have to. The weird part is I felt dumb it took a near miss to get me to do something this simple. Anybody else have a close call that finally pushed them into better habits?

Pro tip: That 'urgent' email from your boss was actually a phishing test

I was sitting in a coffee shop in Portland last Tuesday, sipping my latte and checking work email on my phone. There it was - an urgent message from our CEO saying our payroll system was compromised and I needed to click a link to reset my password immediately. My heart jumped at first... but then I noticed the sender address was off by one letter. I flagged it to our IT team instead of clicking, and they told me I was one of only 12 people out of 200 who didn't fall for their security drill. Has anyone else caught these fake executive emails before?

My entire company got hit by a phishing attack in one afternoon last Tuesday

It started with an email that looked exactly like our HR portal asking everyone to update their direct deposit info. Within 3 hours, 12 people had clicked the link and entered their login credentials including me. Our IT guy caught it when he noticed the domain was off by one letter, hr-portal instead of hrportal. By then the attacker had already accessed payroll files and sent fake wire transfer requests totaling $14,000. Has anyone else dealt with a spear phishing campaign that targeted your whole team at once?