PUBLIC DEFENDER By Brian Livingston It seems we all have to deal with different usernames and passwords for every website we visit and every device we
[See the full post at: Do you need a password manager?]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
Do you need a password manager?
- This topic has 79 replies, 31 voices, and was last updated 1 year, 2 months ago.
AuthorViewing 44 reply threadsAuthor-
Don’t tell anyone — It’s SECRET!
I never see any of the reviews mention the one PWM I’ve been using for years and it is superb. There’s a version for Windows and Android though not with identical functionality. If anyone wants the website just let me know…
3 users thanked author for this post.
-
I too use Password Safe. But I use it with a Yubikey – another factor. Syncing is easy, I put it on a USB drive.
But as for trying your password at Have I Been Pwned – once you try it haven’t you put it into their database? What a simple way to accumulate millions of passwords!
My main gripe is about usernames, though. How many lazy websites insist on using your email for a username? It makes it easy to target specific people. Where ever possible I use a random string for my username as well. It’s easy to do with a local password manager like Password Safe.
-
-
I am sorry but I just don’t get it. If you have your laptop stolen at the airport or coffee shop and the perp does a brute force attack to get into the laptop with your “PIN”, then since your laptop has Passkey access to say AskWoody, can’t the perp then go right into Woody?
But with a Password to Woody the perp would be stopped.
3 users thanked author for this post.
-
-
If you have your laptop stolen at the airport or coffee shop and the perp does a brute force attack to get into the laptop with your “PIN”, then since your laptop has Passkey access to say AskWoody, can’t the perp then go right into Woody?
It could take years to brute force even a four-digit PIN due to TPM 2.0 anti-hammering lockout period after 32 attempts (then one per 10 mins).
1 user thanked author for this post.
-
-
For me the one and only password manager is Sticky Password. Why do I feel that it is the only one I will ever use? It is because it is not web based. If you want to sync it with your phone or laptop or desktop, it is done via wifi. Unlike Last Pass that was hacked, Sticky Password will never be hacked if you set it up properly. And, unlike the others, you buy a lifetime license not an annual fee.
1 user thanked author for this post.
-
-
-
Humm. On a Google search one site “LogMeOnce” has the summary that they can crack a 6 digit PIN instantly.
Not with TPM 2.0 anti-hammering. Six digits would take 19 years.
1 user thanked author for this post.
-
-
-
Did you notice a pattern there? Out of the 19 password managers that were reviewed, the following five were recommended by the greatest number of test labs:
- Bitwarden, Dashlane, 1Password, NordPass, Keeper
Another thing I noticed is that not one of those five appeared on all 19 reviewers. I just checked over 100 passwords stored in my password-protected Excel file at Have I Been Pwned, and all of them were clear. And there’s this:
“Firefox Sync
If you have a Mozilla account and enabled the Sync functionality, your sync login data (usernames, passwords, hostnames) is fully encrypted once it’s created and/or modified. However, Mozilla cannot decrypt your usernames and passwords when they are stored on the sync server.
If you forget your Mozilla account email and password, Mozilla will not be able to recover your sync data as we do not have access to it.”I don’t feel the need for a password manager, nor do I feel the need for a passkey until passwords are no longer accepted.Always create a fresh drive image before making system changes/Windows updates; you may need to start over!We all have our own reasons for doing the things that we do with our systems; we don't need anyone's approval, and we don't all have to do the same things.We were all once "Average Users".1 user thanked author for this post.
-
-
I’m a lawyer, so uploading attorney-client data to the cloud has always been off-limits, regardless of how well I think it may be encrypted. I have always been suspicious of the cloud, mainly because most vendors offer small amounts of data free (say under 5 GB). I believe the rubric that if something on the internet is free, then you must be the product. I wonder what vendors look for when scanning uploaded data? I won’t belabor my local backup system here.
I have hundreds of passwords stored in Roboform. However, they are easily exportable to other password managers if it becomes necessary to change. I’ve used Roboform since 2003 and find myself reluctant to part with it.
I have some questions and comments concerning the article.
(1) I suspect that checking your password against the “Have I Been Pwned” website merely adds another password to the database of compromised passwords. Despite the site’s claim that it does not store passwords, Microsoft’s track record for truth-in- advertising has not been good.
(2) Passkeys (to my mind) are a troubling new development because of their heavy reliance on biometric data, even if the biometrics are allegedly stored on a local device. Unless you disconnect from the internet, local devices are in constant communication with external servers. Non-technical persons like me have no idea what data is being uploaded to those servers.
Yes, I know TSA is now requiring biometric facial recognition scans to fly domestically, and law-abiding citizens are required to submit biometric data when entering or leaving the country, but that does not make submission of biometric data any more palatable. Good proles, of course, should be willing to submit any biometric data requested at all times and in all places.
(3) If you refuse to provide biometric data, what options are left? Passkeys apparently can be created with a mere PIN. What if FIDO, Google, Amazon et al. decide a PIN is not good enough? Why are Passkeys are superior to (for example) RSA SecurID or Yubikey? Could SecurID or Yubikey be used as the third leg of a Passkey in lieu of biometric data?
We are entering a Brave New World of authentication. I find these new methods difficult to understand and somewhat disturbing.
-
- I can confirm that the website “Have I Been Pwned” does not store passwords that you test by entering them. I’ve entered some passwords multiple times over the years, and the site has never said my passwords match the database of 12 billion credentials that are circulating on the Dark Web. I’m a sample of one, of course. But if you have any indications that HIBP is storing user data, let me know and I’ll publish the evidence. Microsoft does not own or run HIBP.
- If your phone or laptop recognizes you by your face (biometric data), it should never transmit a picture of your face across the Internet. Instead, when challenged by a server, your device should reply, “Yes, an authorized person presented a correct face today.” Your device would then use public/private key handshaking to sign you in to the server. By contrast, uses of biometric data by third parties is a topic we should be concerned about. For instance, in order to present evidence to the IRS last year, I was required to send to ID.me a video selfie of my face turning slightly from left to right (to ensure I was not holding up a photo). The IRS announced in February 2022 that it would shift away from facial recognition. At this writing, all they’ve accomplished is to add the alternative of a video chat with a live agent. As another example, I was required to submit a video selfie in 2021 at a big-box store to qualify for credit when buying a new WASHER/DRYER! The reason for these intrusive requirements, of course, is that criminals steal billions of dollars every year through online fraud. We absolutely need positive means to prove we are who we say we are. Passkeys won’t solve every problem, but they are a step in the right direction.
- I recommend the use of tiny USB-port devices such as the Yubikey. A photo of one such device appeared in my Nov. 20, 2023, column, and I’ve also attached it. These plug-ins can be used to sign you in to your device without a password (or, alternatively, you can still enter a password, if your fingers happen to be covered in grease or whatever). Your passkey, which is stored in a secure enclave on your device, would then respond correctly to challenges, getting you into Web servers that support passkeys. I can’t cover here what to do if some hated government agency — say, the Kremlin — demands from you a facial scan for admittance. That’s a separate topic, but with the amount of fraud on the Net, we’re all certain to some day face that (no pun intended).
6 users thanked author for this post.
-
-
-
-
-
-
Saving credentials in FF means you can’t use them in another browser, or an app (Excel etc). It also means you can’t store other info, like CC data, Passport info, SS number, insurance details etc.
Get a password manager and store all your important data in it, then you have a simple, portable, independent store of your valuable data – and make a backup of the password store, you can never be too careful.
cheers, Paul
1 user thanked author for this post.
-
-
KeepassXC is my favourite, its open source, regularly maintained, creates a Cross platform encrypted Database and it even suggests passwords of what ever complexity that you choose. I assume its good on Linux but it works well on MacOS, Windoze 10 & 11 and Android. I would imagine it’ll work in iOS and best of all the Program is gloriously free including updates you can find it in Github or the Home Page.
-
-
Passkeys don’t require separate two-factor authentication:
What is a passkey and how does it work?
Passkeys are a form of authentication that allow you to quickly create and sign into accounts – without having to use a less secure password. This single-step, secure login method replaces traditional authentication methods, as well as the two-factor authentication (2FA) process.
Passwordless Future: A Comprehensive Passkeys FAQ [BITWARDEN RESOURCES]
1 user thanked author for this post.
-
Passkeys are a form of two-factor authentication. The first factor is that you were able to sign in to your device using a PIN, a fingerprint, your face, or whatever. The second factor is that the device contains a private key. This enables the device to correctly respond to a challenge sent by a server (which holds a public key). What passkeys don’t require is servers sending you 2FA codes via email or text message; both methods are vulnerable to hackers.
1 user thanked author for this post.
-
-
-
I also use PasswordSafe on my PC and Android phone. I think the reason it doesn’t get much love is that the interface is rather clunky. I’ve been using it ever since it came out years ago. It’s easy to configure and I like the fact that it is not integrated into my browser. I would rather go through the extra step of copying the password into the browser than having it remembered other than for news and streaming sites. Anything with financial information is set to 2FA. There is also a Yubi Key option for those who want more security.
-
-
-
My main gripe is about usernames, though. How many lazy websites insist on using your email for a username?
I agree wholeheartedly. Everybody in the world now knows your email address and if you have your name as your email address the hackers are one step closer to hacking you. Yet, almost every web site forces you to use the email address as your userid.
With a non email userid, a good password, and text code you actually have 3 step authorization but nobody wants to do that anymore. Convenience or security. And we wonder why so much hacking is happening.
-
Not everyone in the world knows our e-mail addresses.
We use an email service provider that allows us to have up to 100 “alias” e-mail addresses.
So, if someone like AskWoody asks us for an address we simply setup a new address such as askwoodyaquestion@xxxxxx.com.
We then record both the email address and password in our “password manager”.
-
-
-
I don’t use and never needed password manager and I don’t save passwords in browsers.
I remember user/password for all the sites I browse daily / weekly.
I have a small list of rarely visited sites in a password protected 7zip txt file.1 user thanked author for this post.
-
-
“check whether your email address and any passwords you use appear in databases of stolen credentials that are widely sold on the Internet. The easiest way to do this is to visit the password-checking page of a website named Have I Been Pwned”
The problem with checking your email address appears to be that if your email address shows up and you change your password as a result, your address will still always show up whether there has been a newer breach of your address or not. So after the first time you are none the wiser.
Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie
3 users thanked author for this post.
-
“whether you need one at all.”
If you use a single email address and the same password for every logon, then you will not need a PWM!
I, OTOH, have around 300 email addresses, most through a temporary email service, 10 or so through Google GMail, so need one. I have used KeePass since forever.
-
-
-
-
-
-
Not everyone in the world knows our e-mail addresses.
We use an email service provider that allows us to have up to 100 “alias” e-mail addresses.
So, if someone like AskWoody asks us for an address we simply setup a new address such as askwoodyaquestion@xxxxxx.com.
We then record both the email address and password in our “password manager”.
Yes! Exactly!
I’ve been doing the same for at least 15 years. I never give my “real” email address when registering on a new website (business, service, forum, etc). No offense, but anyone not doing this is a fool or ignorant of the consequences of giving out your email address to the world.
Two services (both free) I’ve used for many years with great success are: http://erine.email and http://spamgourmet.com
1 user thanked author for this post.
-
If your phone or laptop recognizes you by your face (biometric data), it should never transmit a picture of your face across the Internet.
To me, there will never, ever be acceptable reasons to trust any company, any where, at any time, to *not* transmit such a thing. For over two decades I’ve had an interest in reading the news about the largest scale thefts of data. They are now commonplace.
And although I realize these things, one of the most hacked and hackable organizations in the world, the US guv’mint, has beacoup information on me. Coming back into the US recently I avoided some fairly long lines at customs, when my face was scanned with a camera at an automated Global Entry Pass kiosk. The rest of our traveling party had their suitcases opened by customs. I didn’t have to do that.
The guv’mint’s machine took of photo of me and allowed me through. No attendant needed to run the thing. No one else in line. Just one guy directing me to the kiosk while he stood back and let the machine recognize me and let me through.
But I prefer to have choices over which organizations and companies know about me, and which do not.
Human, who sports only naturally-occurring DNA ~ oneironaut ~ broadcaster
-
Hi Brian,
In your article you list three ways that hackers could gain access to your passwords. Those are all valid scenarios, but you missed the one that is by far the most common – phishing.
If a hacker wants your M365, Google, Facebook, bank, etc credentials they are just going to trick you into giving your password to them. It used to be that phishers had plenty of success with simply asking people to send their passwords, credit card numbers, etc in plain text email. As people have become more paranoid, those sorts of simplistic phishing attempts aren’t as successful anymore. Now phishers will trick you into visiting a website that looks identical to the login page that you are accustomed to seeing. Through the use of phishing toolkits like Modlishka or Evilginx, they can even steal your MFA codes, because these tools are actually presenting the real login page to you through a man-in-the-middle proxy. With a MITM proxy you are actually logging into your online account (M365, Google, etc), but in the process the phisher has harvested your password, your MFA code and your session cookie.
The cyber security community has been saying – for more than 20 years – that passwords are dead as a security technology. MFA technologies (even the weak ones like email and SMS codes) are a crucial stop gap measure along the path to more robust forms of authentication. Unfortunately, MFA wasn’t rolled out as part of a coordinated standards effort, so we now have an incredibly splintered landscape of MFA approaches that cause most regular people no end of frustration. Password managers are also an important security enhancement, but they too are a band-aid aimed at dealing with the incredibly poor password choices that the vast majority of people make.
Today, the only web authentication that can protect you against phishing toolkits like Modlishka, is a FIDO authentication method. Hardware tokens, like Yubikeys, are currently the most secure FIDO authentication method. Passkeys are the newest FIDO authentication method and I hold out some hope that they will really catch on but, from what I’ve seen over the past 20+ years, there will be an incredibly long tail of websites that either never adopt FIDO authentication or it will take them more than a decade to do so.
<span style=”text-decoration: underline;”>At this time the best advice I can offer is this (in descending order of importance):</span>
- Treat your email account as the most security sensitive account you have, because it is. If a hacker compromises your email account, they can simply reset your password at your bank, social media account, etc. They can also impersonate you to your friends, vendors, customers, etc. I can’t stress enough that your email is the keystone in the arch of your online identity, if it is compromised the attacker can now act as you just about anywhere online and thus the whole arch will fall.
- Use trustworthy devices. As you pointed out Brian, if your PC is compromised, all bets are off. Most PCs, whether Windows, Mac or Linux are not really very trustworthy as most people don’t know how to configure them to be secure and to maintain them properly. iOS devices are significantly more secure and easier to maintain than most PCs and Android devices are somewhere between the two. If your email address is the keystone in the arch of your digital identity, your devices are the ground that is holding up the arch. Shaky ground or a poor foundation will cause even the most robustly built arch to fall.
- Use a reputable password manager (there are lots of really bad ones)
- Your password manager must be protected by a long master password
- If your password manager is accessible through a website, make sure you use phishing proof authentication, either as the primary authenticator or as a second factor and only ever access your account from a trusted and trustworthy device
- Never re-use passwords anywhere. You should use a unique password for every site/service/account.
- Passwords should be randomly generated and since your password manager is managing them for you they should be 20+ characters long because, well why not?
- Wherever possible, use phishing proof authentication (FIDO) such as Yubikeys or passkeys, either as a primary factor or a second factor
- Never ever store your passwords in password protected Excel files. Anyone who spends a few minutes looking online for Excel macros for defeating password protected spreadsheets will learn that Microsoft NEVER should have added this feature to Excel. It gives people a false sense of security where there is absolutely none.
- Avoid trying to be clever, such as rolling your own password manager. It’s just so easy to get it wrong in ways that can leave your passwords exposed without you understanding why (I’m looking at you 7zip encrypted text file).
- Because, your email account is so security sensitive, you really should not use any of the thousands of integrated online services that you can authorize to read and send email on your behalf – Eg Grammarly, most CRM tools for businesses, etc. I know they’re convenient and perhaps even helpful, but if their systems are compromised, then it’s possible that an attacker can access your most sensitive online accounts. I fully expect to see a dramatic rise in OAuth related account compromises in the next few years, because this spider web of SaaS integrations is creating a vast and largely invisible landmine of tokens, both in your browsers and on SaaS servers.
- Finally, realize that no matter how secure you may think your devices and authentication methods are, if you’re storing sensitive data in online accounts, that data is now out of your control and can be compromised despite your best efforts. In fact chances are extremely good (based on breach statistics), that you will have at least one of your online accounts directly compromised or compromised in a breach this year. The state of many (most?) companies’ cyber security is much worse than you might expect. I’m not telling you to go live in the woods without any Internet connection, but rather that at some point you have to decide to what degree you want to participate in society. For better or for worse, more and more of our world is moving online and increasingly you won’t have the option of opting out. Perhaps it would be wise to strive for some measure of spiritual detachment from our highly materialistic world and accept that you really can’t maintain control of your “stuff”. You can do the very best you can, but beyond a certain point you’ll just tie yourself in paranoid knots and your quality of life will suffer.
-
I forgot to add one incredibly important point. The more effort you put into protecting your data using encryption, the more likely you are to eventually have an accident that permanently and irretrievably results in the loss of your data.
Encryption, as employed by password managers and many other security tools, is not something that can be unlocked by a call to the help desk of your password manager vendor. If you lose your encryption keys, your data is completely gone forever.
1Password has a good feature for consumers called the Emergency Kit. It’s a PDF that you can download, print and then store in a safe deposit box. DO NOT LEAVE THE PDF FILE ON YOUR PC, this is much worse than a password protected Excel file. The reason I recommend a safe deposit box is that this becomes your “help desk”. You can always go to your bank, prove your identity to them and gain access to your safe deposit box. This way your Emergency Kit paper won’t be lost in your filing cabinet, destroyed in a flood or fire, etc.
Having a 1Password family or team account is also a hedge against complete loss of your data, but this also increases your attack surface because now an attacker can compromise your family member and thus gain access to your vaults. I still think the safe deposit box is currently the best option for people that really want to protect their stuff, but they still want to protect themselves, from themselves.
A safe deposit box isn’t cheap, but depending on the value of the secrets you’re protecting with encryption (think of the ridiculous stories of people losing millions in Bitcoin due to not having a securely stored paper copy of their Bitcoin wallet address), it might actually be cheap insurance.
-
-
-
Passkeys don’t require separate two-factor authentication:
Correct me if I am wrong, but let’s say a person has 50 accounts to access on their PC:
Scenario 1) A hacker gets into your PC by your accidental clicking of a link in an email. If all 50 accounts are set up with Keypass or Authenticator App, the hacker looks at your Favorites list and accesses any or all instantly. You cannot change the embedded access codes and don’t have time to phone call 50 accounts. You’ve had it!
Scenario 2) A hacker gets into your PC by your accidental clicking of a link in an email. If all 50 accounts are set up with unique ID/passwords, the hacker looks at your Favorites list but does not have the passwords so cannot do anything unless you were stupid enough to store the passwords on your desktop. You have plenty of time to change the passwords as a precaution.
Solution) My solution to this which lazy companies and lazy people probably won’t do is:
A web site should be initially accessed by the current ID/password and then for the 2fa initiate the request for the passkey or authenticator app code.
This should lock out both scenarios. Since people seem to prefer convenience over security I doubt this would ever happen.
To look at this another way I always use a hardware steering wheel lock on my car. When the thief uses a copycat FOB my steering wheel lock is the keypass that stops the thief. The thief without a copycat FOB is stopped by my regular door lock (the password). Yes, inconvenient but more secure. (I know the thief has other ways but then you need 3fa (siren alarm).
2 users thanked author for this post.
-
-
If all 50 accounts are set up with Keypass
Passkeys require biometric authentication…
“With passkeys, users can sign in to apps and websites with a biometric sensor (such as a fingerprint or facial recognition), PIN, or pattern, freeing them from having to remember and manage passwords.”
-
-
-
Sorry I am confused but does that mean if I have, say, Amazon set up for keypass and I then go to http://www.amazon.com and it then asks me for a PIN? Seems like having 50 different PINs is same as keeping up with 50 different passwords. I won’t even go into how I would submit a facial on a desktop.
No. You have one PIN, which doesn’t leave your computer, for all stored passkeys.
I was under the impression that on Authenticator a code was generated that the website accessed on the PC and that keypass was similar so was like an automatic sign in. Thanks.
I don’t think it helps much to compare passkeys with an authenticator app, because an authenticator provides 2FA/MFA for passwords and passkeys are about eliminating passwords.
-
Passkeys are a one time setup and do not use additional authentication / code, but they are tied to your device.
cheers, Paul
1 user thanked author for this post.
-
-
-
Yes, once hacked a malicious user can get into your stuff. The same is true of a password manager, but not 2FA, although if you have all the details you can reset stuff anyway.
The point is, if you are hacked, all bets are off.The advantage of passkeys is you don’t have dozens of credentials to store and logon is a simple, enter your PIN. And you can supplement with 2FA.
cheers, Paul
1 user thanked author for this post.
-
Yes, once hacked a malicious user can get into your stuff. The same is true of a password manager, but not 2FA, although if you have all the details you can reset stuff anyway.
The point is, if you are hacked, all bets are off.The passkey PIN (or face/fingerprint) protected by TPM has to be entered on the computer storing the private passkey, so remote attack would fail.
The advantage of passkeys is you don’t have dozens of credentials to store and logon is a simple, enter your PIN. And you can supplement with 2FA.
Passkeys are a form of 2FA but can’t be supplemented with anything.
1 user thanked author for this post.
-
-
-
If a hacker is able to plant a Trojan horse on your device, it does not mean that the hacker would immediately have access to all the websites that you’ve established accounts with.
The Trojan would have be to able to run your device, open Web browsers on it, and so forth. Why would a hacker bother to do this on your one machine? He or she could easily sign in to websites using some of the 12 billion username/password combinations that are widely available for sale on the Dark Web.
Understandably, if someone breaks into your office or home and steals your computer, the thief can then do anything that your computer can do. (The thief can sign in to banking websites using passwords that you carelessly stored in your browser, etc.)
But no technology can help you if someone can break in and physically possess your device. Keep them locked up and secure.
1 user thanked author for this post.
-
1 user thanked author for this post.
-
Understandably, if someone breaks into your office or home and steals your computer, the thief can then do anything that your computer can do. (The thief can sign in to banking websites using passwords that you carelessly stored in your browser, etc.)
Unless browser passwords are protected with a custom primary password:
Keep your saved passwords private with custom primary password [Edge]
1 user thanked author for this post.
-
-
b wrote: an authenticator provides 2FA/MFA for passwords.
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
So does a web site ask you to enter the authenticator generated code after entering a password.Yup, that’s exactly how it works!
1 user thanked author for this post.
-
-
-
-
Recently I miss typed a web address by one character and a hacker was waiting at that address. I even had something called Acronis that is suppose to guard against mistyping an address and that let the hacker through. It can happen to anyone anytime.
That’s something that passkeys absolutely prevent, because a passkey can only be used for the completely genuine site which created it.
So Authenticator seems to me the ideal solution if one does not mind dealing with passwords and keeps them safe through the above safeguards mentioned. You get the security of individual site 2fa and the authenticator codes are not transmitted like text and change every few seconds.
I use Microsoft Authenticator all the time (and as a password manager), but an authenticator app can’t protect against typo-squatting or phishing like passkeys.
1 user thanked author for this post.
-
Recently I miss typed a web address by one character and a hacker was waiting at that address. I even had something called Acronis that is suppose to guard against mistyping an address and that let the hacker through. It can happen to anyone anytime.
You don’t have a firewall? That should have kept you safe.
Also, running with scripting turned off solves problems like this. But then you might have to enable scripting at each new website (some still work with scripting disabled, many do not). This is easy to do with NoScript in Firefox with NS shown in the status bar, so you can enable/disable scripts directly.
Although admittedly, this is all a bit complex for non-techies.
1 user thanked author for this post.
-
-
Recently I miss typed a web address by one character and a hacker was waiting at that address
Any proper A/V running web protection would have block bogus URLs.
-
Yes, MalwareBytes as browser-adon, free of charge.
And MalwareBytes Antimalware , payed licence, active running is guarding the searchstring going to the internet.
Together they are quite effective.
Even Bitdefender free version does good, also in combination with the browser adon from MalwareBytes.* _ ... _ *
-
-
-
-
-
Recently I miss typed a web address by one character and a hacker was waiting at that address.
Another reason why bookmarking sites (assuming it’s not a one-off) is a good idea.
1 user thanked author for this post.
-
Another reason why bookmarking
2 thoughts on that. Yes, for general sites like Amazon that probably everyone has. However, for your bank, not a good idea because if the hacker gets in, the hacker now knows the bank you use, and if the hacker already has a dossier on you could call the bank and … well you know.
It is better to keep those web addresses on an encrypted list somewhere that you can click kind of like an encrypted bookmark.
After all, the world of hacking is all about getting all the keys to your life and then walking right in.
Security is NOT convenient. To beat the hackers you need data access by unique userid (not your email address) then unique password then device generated authenticator on a device protected by some kind of token or other sign in ID at minimum.
Until then the wolves will continue to plunder the sheep. (Or until we can trap the wolves.)
1 user thanked author for this post.
-
However, for your bank, not a good idea because if the hacker gets in, the hacker now knows the bank you use, and if the hacker already has a dossier on you could call the bank and …
A valid point I hadn’t really considered. I guess it comes down to which you think is more likely/riskier – that a hacker gains control of your device, or that you mistype an URL.
1 user thanked author for this post.
-
-
-
I still think the safe deposit box is currently the best option for people that really want to protect their stuff
Not necessarily so. Read this story:
“There are an estimated 25 million safe deposit boxes in America, and they operate in a legal gray zone within the highly regulated banking industry. There are no federal laws governing the boxes; no rules require banks to compensate customers if their property is stolen or destroyed.”
https://www.nytimes.com/2019/07/19/business/safe-deposit-box-theft.html
Then there is the problem of when the safe box holder dies. No one will be able to get access to that box unless they have the death certificate and are the estate administrator. If you don’t have an estate or a legal administrator, good luck…
-
-
You can often beat MSM paywalls by going through the https://archive.ph/
Here is the unpaywall link to the article:
1 user thanked author for this post.
-
-
-
Viewing 44 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Login screen icon
by 2 hours, 38 minutes ago
-
AI coming to everything
by 27 minutes ago
-
Mozilla : Pocket shuts down July 8, 2025, Fakespot shuts down on July 1, 2025
by 10 hours, 5 minutes ago
-
No Screen TurnOff???
by 10 hours, 27 minutes ago
-
Identify a dynamic range to then be used in another formula
by 11 hours ago
-
InfoStealer Malware Data Breach Exposed 184 Million Logins and Passwords
by 22 hours, 37 minutes ago
-
How well does your browser block trackers?
by 8 hours, 54 minutes ago
-
You can’t handle me
by 1 hour, 22 minutes ago
-
Chrome Can Now Change Your Weak Passwords for You
by 1 hour, 31 minutes ago
-
Microsoft: Over 394,000 Windows PCs infected by Lumma malware, affects Chrome..
by 1 day, 9 hours ago
-
Signal vs Microsoft’s Recall ; By Default, Signal Doesn’t Recall
by 13 hours, 29 minutes ago
-
Internet Archive : This is where all of The Internet is stored
by 1 day, 10 hours ago
-
iPhone 7 Plus and the iPhone 8 on Vantage list
by 1 day, 10 hours ago
-
Lumma malware takedown
by 22 hours, 44 minutes ago
-
“kill switches” found in Chinese made power inverters
by 1 day, 19 hours ago
-
Windows 11 – InControl vs pausing Windows updates
by 1 day, 19 hours ago
-
Meet Gemini in Chrome
by 1 day, 23 hours ago
-
DuckDuckGo’s Duck.ai added GPT-4o mini
by 1 day, 23 hours ago
-
Trump signs Take It Down Act
by 2 days, 7 hours ago
-
Do you have a maintenance window?
by 12 hours, 3 minutes ago
-
Freshly discovered bug in OpenPGP.js undermines whole point of encrypted comms
by 1 day, 9 hours ago
-
Cox Communications and Charter Communications to merge
by 2 days, 10 hours ago
-
Help with WD usb driver on Windows 11
by 2 hours, 49 minutes ago
-
hibernate activation
by 2 days, 19 hours ago
-
Red Hat Enterprise Linux 10 with AI assistant
by 2 days, 23 hours ago
-
Windows 11 Insider Preview build 26200.5603 released to DEV
by 3 days, 2 hours ago
-
Windows 11 Insider Preview build 26120.4151 (24H2) released to BETA
by 3 days, 2 hours ago
-
Fixing Windows 24H2 failed KB5058411 install
by 1 day, 22 hours ago
-
Out of band for Windows 10
by 3 days, 7 hours ago
-
Giving UniGetUi a test run.
by 3 days, 14 hours ago
Remembering Woody
