@Anonymous wrote:
@iced wrote:
@Anonymous wrote:
Do you think this 22 character password is secure enough to use on all the accounts I don't care about, and then have a different password for the accounts I do care about? (like my bank, google account, and credit card accounts.) I have about 55 to 70 accounts, and I only care about 6 of them. I know it doesn't sound smart to use the same password on 50+ accounts however, I feel like no one is ever going to be able guess a password with 22 unique characters, Maybe I wrong though?
No. The bar for a script kiddie breaking your password the old-fashioned/l0phtcrack way is much below 22 random/unique characters, provided you aren't doing anything stupid like putting your first and last name together and replacing a's with 4's and that kind of stuff. Rather, most account breaks today are a matter of exploiting a vulnerability that exposes the password in the clear for the kiddie to see. The complexity of the password really doesn't matter when it's right there in front of them.
Am I reading that wrong, if that is the case then it doesn't matter what my password is, I am screwed either way?
This is also part of why having unique passwords is one line in defense-in-depth. If you re-use the same password, no matter how complex, you're only as secure as the weakest application you access with that password.
If you're paranoid about this happening again in the future, you should also go with MFA (multi-factor authentication) on applications that support it, usually with a OTP (one-time pin). This can be either via a text message to your mobile device, or a soft-token such as RSA/VIP. Most financial applications support this.
Is this 2 step verification or something else? If it is 2 step then I already have that. Google completely failed 2 step verifcation twice now. Wells fargo seems to be the only one with 2 step that works for me (I don't use it on many things, just google and now my bank)
TouchID access is not a replacement for MFA, unless you have to enter your thumbprint in addition to a password. Most applications replace needing to enter the password with the touch, which can actually be less secure. A valid use of Touch ID as part of MFA is E-Trade's iOS app - after touching, you are then additionally required to enter a OTP from a token.
I don't know, I might use a password manager, I still need to think about it I guess. In reality, the only 2 things I truly care about are secure now, I recently turned on 2 step for my bank and amazon. (I have to enter a code everysingle time I log in) I would LOVE for my gmail to be secure as well, however google doensn't want that for me obviously, otherwise I would not only be promptly alerted someone has hacked me but 2 step would also work.
Side note, I think the main problem I have with password managers is the ones recommended in this thread have been compromised in the past according to google when I look them up. If they are supposed to be so secure, why are they having that problem? Also is there anything I can do to actually make my gmail secure?
You are not reading that wrong. Some systems store passwords in a reversible hash (bad) that can be broken/reversed. Some systems store the password in the clear on a DB (really bad) so breaking into the DB leaks all the passwords. Sometimes, it's even something more obscure, like a cookie holding a password for automatic login or the password being stored in volatile memory and malware on your host is reading the memory and extracting the password. Keyloggers can get passwords out of people who enter them manually rather than copy/paste. There's a lot of ways to get at data.
Two-step verification is arguably a form of MFA, provided it's doing something like texting you an access code. Simply asking you for two passwords or asking two questions isn't true MFA. Without going into the weeds on it, there's three general factors of access:
1. Something you know (passwords)
2. Something you have (tokens/phone PINs)
3. Something you are (biometrics/TouchID)
Whether you should use it or not is a matter of personal risk assessment.
As for GMail, they do have MFA options. Check out https://myaccount.google.com/security after you've logged in to see what you can do.
Lastly, before it gets lost in all this - just because there are ways to get around even the most complex password doesn't mean one shouldn't strive for that. Keep your passwords complex. Change them often (several times a year at a minimum for sensitive/financial accounts). Don't re-use passwords across sensitive accounts, but even as a security person I'll give a pass to those who want to use one password for all their forums. If you want to break into my MF account so you can log in and post on FT, be my guest, but don't expect that to get into my email, bank accounts, or credit cards.
