2023 Security Check-up Reminder

  • 🏰 The Fediverse is up. If you know, you know.
  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
Virgin moron who boasts about his 66GB porn collection under his real name responds to this thread and comments on KF's opsec
1678309617815.png

1678309662579.png

more about him on his thread
 
supremeautismo said:
Possible Woman Moment ™️, but I refuse to have any passwords available online, including a password manager, saved via browser, etc. Got a notebook with a lock on it and a hidden key. If someone’s breaking into my house, I have more problems than my Protonmail account getting hacked.

You could spend a pretty chunk of change installing security and alarms for your new car— or, you could buy a $40 steering wheel lock, 1970s style. Sometimes what always worked, still works.
Click to expand...
Yeah I have a major mental block when it comes to password managers. I know Josh always recommends them but I feel like I am;handing my passwords to a service I have no reason to trust.

@Null you know a lot about this stuff; could you explain to me why I am mistaken about password managers?
 
Remember, friends, KF had a database breach a few years ago (iirc it was mostly a dump of emails, IP addresses, and usernames from the last several hundred people who connected to the site). Someone tried to breach late last year. It can happen again.

Privacy Tool's website endorses SurfShark VPN, but I don't trust a company that YouTubers shill.
 
Meat Target said:
It's a never-ending arms race. Nobody can afford to be complacent.
Click to expand...
To a degree, yeah. But if you're an irrelevant, low-profile person and every online account you use has a unique password that will take hundreds of centuries to crack, you don't have that much to worry about, short of being keylogged.
 
If you asked me to pick the least likely type of person to run a site like chudbuds, 'married woman with kids' would probably be in the top 5.

The more I think about it the more I am in awe.
 
Meat Target said:
I'm also ditching LastPass. Had an IT vendor at work today tell us that it's not safe anymore.
Click to expand...
TL;DR They have weak key derivation mechanisms for a lot of older accounts still in place since forever, but claim no one was at risk because the attacker would not be able to decrypt the gathered data. Which is also not true because URLs for services were apparently not being encrypted, because they were regarded as "not sensitive".
Early accounts have something like 1000 iterations of PBKDF2 which can be broken apparently (compare that to 100k iterations on newer accounts).



Just read the comments of all the people mad about never having their masterkey re-generated with better security.

PS: Oh right, that's from 2021. They were hacked again in 2022 because they didn't change their own keys/passwords IIRC. Who would want to leave their passwords there, wtf...
 
Last edited:
RotPockets said:
Care to review my OpSec?
- Hide My Email disposable emails (single use)
- generated passwords (single use)
- 2FA (locked with FaceID)
- Nord VPN
- local Pi-hole (blocking telemetry & ads)
- Private Relay (when using Mobile network)
- AdGuard Pro (when using Mobile network)
- encrypted iPhone (FaceID)
- encrypted backup iPhone (TouchID) for locating, locking, or erasing main iPhone.
4111A32C-C338-4887-95C1-8167AA9C9D90.jpeg
EEEA370C-3B91-48FC-8D75-EB11E970C6BF.jpeg
(Example email address, not actually in use)
2B70F04E-17A0-4D4A-BC87-F3734470A52C.jpeg
Pi-hole statistics to show how much unnecessary traffic can be blocked.
93A4ABAA-93BA-4EE6-BF19-924D0DC1BCF5.jpeg DB8BAE3D-B3F5-41AD-B226-D08BA6DC787E.jpeg
AdGuard Pro blocklists, not as extensive as Pi-hole.
Click to expand...
I tried to ask if there were any glaring holes in my approach, but apparently I angered the Android fanboys by using words they didn’t understand. FYI every Android Firmware has Facebook integration baked in to the OS, if you remove it, it breaks the firmware.
 
Last edited:
Prj4MW8iPT3vmFM2rzDc said:
I use a unique password for/to every login(nothing shares as pw) i have that is the maximum characters the system/site allows that is randomized upper case characters, lower case characters, numbers, allowed symbols for the system/site, and unicode ascii if possible.

Am I doing it correctly?
Click to expand...
You want a different email for every website, or at least the ones you don't want to be linked together. You could use mail forwarding like Null mentioned.
 
RotPockets said:
I tried to ask if there were any glaring holes in my approach, but apparently I angered the Android fanboys by using words they didn’t understand. FYI every Android Firmware has Facebook integration baked in to the OS, if you remove it, it breaks the firmware.
Click to expand...
I don't trust Nord, personally. Mullvad and ProtonVPN are alternatives I like.
 
I would trust a random KiwiFarmer, especially ones whose join dates are before December 7th 2022, far more than I do most mainstream media or even law enforcement.

Though that isn't saying much given the state of media and law enforcement.

Also I would never use a password manager. I generate long passphrases and keep them on a physical piece of paper. Good luck hacking a sheet of cellulose glowniggers. And good luck guessing which random string of schizo text is a password for which account and which ones are just meaningless babble.
 
TheDarknessGrows said:
Yeah I have a major mental block when it comes to password managers. I know Josh always recommends them but I feel like I am;handing my passwords to a service I have no reason to trust.

@Null you know a lot about this stuff; could you explain to me why I am mistaken about password managers?
Click to expand...
password managers are better than using the same password everywhere, because they protect YOU from a site leak like this

HOWEVER they can result in "all eggs in one basket" and if you use anything that has online password syncing, you now are reduced to "what if that gets hacked wide open" which is something to worry a bit about.

The good ones keep everything encrypted at all times and require your master password, but that could still leak. It all depends on how paranoid you need to be, but a password manager is way above same password everywhere ralph style.

one thing I've not experimented with is letting the browser store which EMAIL you used, and the password manager store the password, but with no site identifying information.
 
Preacher ✝ said:
You can have burner gmails if you know what you're doing with them.
Click to expand...

Gmail usually requires "recovery" bullshit like emails/phone numbers. It ends up being a gay daisy chain of burners and alts. If Yahoo wasn't so broken it'd be the main email I'd use. Protonmail isn't even accepted by several websites.

It's all so very tiring…
 
Isn't "Correct Horse Battery Staple" far easier to guess than an 8 character random password, if the hacker guesses you're doing that and uses a dictionary attack instead of bruteforcing random characters?
 
You must log in or register to reply here.
Back
Top Bottom