Larion Studios forum stores your passwords in unhashed plaintext. Don’t use a password there that you’ve used anywhere else.

    • finestnothing@lemmy.world
      link
      fedilink
      English
      arrow-up
      53
      arrow-down
      2
      ·
      1 year ago

      Honestly, why risk duplicate passwords even then? I have one strong password that I use for accessing my password manager, and let the password manager generate unique random passwords. Even if I had an easier password that I duplicated with some small changes, I’d still use a password manager to autofill it anyway. I use bitwarden personally, you can also self host it with vaultwarden but it seemed like more trouble than it was worth imo

      • Decoy321@lemmy.world
        link
        fedilink
        English
        arrow-up
        22
        arrow-down
        3
        ·
        edit-2
        1 year ago

        This is a friendly reminder to everyone that password managers are not risk free either. LastPass was hacked last year, NortonLifeLock earlier this year.

        • finestnothing@lemmy.world
          link
          fedilink
          English
          arrow-up
          13
          arrow-down
          2
          ·
          1 year ago

          Personally the risk of bitwarden is outweighed by its convenience (compared to self hosted/local only solutions) in my opinion, but I know that’ll change real quick if bitwarden ever has a breach. If it does I’m jumping ship to a self hosted or local only solution, but I’m hoping that doesn’t have to happen

          • underisk@lemmy.ml
            link
            fedilink
            English
            arrow-up
            12
            arrow-down
            1
            ·
            1 year ago

            Bitwarden is end to end encrypted. If the host gets hacked your passwords are still as safe as your master password is. Self hosting wouldn’t really be a huge help there. Possibly even detrimental depending on your level of competence at securing a public facing web host.

            • Zagorath@aussie.zone
              link
              fedilink
              English
              arrow-up
              8
              ·
              1 year ago

              your passwords are still as safe as your master password is

              They’re as safe as your master password is…and as the encryption is. LastPass famously got hacked recently, and in the aftermath of that many users noticed that their vault was encrypted using very small numbers of rounds of PBKDF2. The recommended number of rounds had increased, but LastPass left the number actually used too low for some users, rather than automatically increasing it. Users of Bitwarden and any other password vault should ensure that their vault is using the strongest encryption available.

              Self hosting wouldn’t really be a huge help there

              Well, self-hosting makes you a smaller target. The most determined attackers are likely going to go after the biggest target, which is going to be a centralised service with thousands of users’ vaults. If you host it yourself they probably won’t even know it exists, so unless there’s reason for someone to be specifically targeting you (e.g. you’re a public figure), or you get hacked by some broad untargeted attack, you might be better off self-hosted from a purely security standpoint.

              (That said, I still use centrally-hosted Bitwarden. The convenience is worth it to me.)

              • underisk@lemmy.ml
                link
                fedilink
                English
                arrow-up
                6
                ·
                1 year ago

                You’re underestimating the attack surface of a self hosted set up. You don’t need to be specifically targeted if, for instance, someone hacks the Bitwarden docker image you’re using, or slips a malicious link into a tutorial you’re reading. It’s not a set it and forget it solution either, you’re responsible for updating it, and the host OS. Like I said, depending on your competency, it’s not inherently more secure.

            • NOT_RICK@lemmy.world
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              I heard people’s LastPass accounts were getting compromised after that theft, but I also don’t know how strong their master passwords were.

              • Zagorath@aussie.zone
                link
                fedilink
                English
                arrow-up
                4
                ·
                1 year ago

                Yeah at this point it’s considered likely that LastPass vaults are being cracked, based on LP being the common link between various other accounts that are being breeched.

                A small number of rounds of encryption being the default for users with old enough accounts is believed to be a significant part of the issue. It means even if their password was a good one, the vault can be brute forced comparatively quickly.

                • wols@lemm.ee
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  1 year ago

                  If their password was actually good (18+ random characters) it’s not feasible with current day technology to brute force, no matter how few PBKDF2 iterations were used.

                  Obviously it’s still a big issue because in many cases people don’t use strong enough passwords (and apparently LastPass stored some of the information in plaintext) but a strong password is still good protection provided the encryption algorithm doesn’t have any known exploitable weaknesses.

        • Hexarei
          link
          fedilink
          English
          arrow-up
          4
          ·
          1 year ago

          Centralized, third party password managers, yes. Local-only managers like KeepassXC though, no concerns over some company getting hacked or cheeky

        • neatchee@lemmy.world
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          5
          ·
          1 year ago

          This is why I don’t use a common centralized password manager, just like I don’t use any of the most popular remote desktop solutions like TeamViewer for unattended access.

          I run a consumer copy of Pleasant Password Manager out of AWS and use NoMachine for unattended access to any machines where I need it.

          Security through obscurity is tried and true. Put as little of your security attack surface in the hands of others as is reasonable.