TeamViewer Hacked

This is why I SSH everywhere. 80 character width is all you need.

Eomer_sl said:

Which do you recommend? Been meaning to set one up for years. It's actually shocking that I've never been hacked, as my password game is incredibly week. I basically use the same couple passwords on damn near everything.

Click to expand...

I use KeePass. I think password vaults have been discussed in the tech subforum but should probably repeat this elsewhere.

Like Denamiam, I store my vault on a cloud drive. Yes, someone could hack your Dropbox or Google Drive or whatever and get your passwords but there's a few things you can do to make this almost impossible even if they get your vault.

Make the password to your vault really long. Like the intro paragraph to Star Wars. Something easier to remember than pUm4&screw!driver and harder for someone to brute force. Yes, you have to remember ANOTHER password but now you can forget all the passwords to websites and such. Use the password vault to generate really long random passwords then use it to logon to websites for you.

Force the password to your vault to go through X amount of transforms before allowing entry. This is essentially a delay on how often someone can enter a password and it's what makes brute forcing your vault almost impossible. It's measured in the equivalent cpu cycles for your computer would equal X seconds.

Use a key file. This is essentially a second password that's cryptographically stronger than any password you could remember. Store it on a usb drive somewhere then lock it up. Only manually put the key file on devices you want to use your vault.

If you want details on how to set all these up, I can look into it more. It's my setup, so I know it's all possible. It sounds like a lot, but really it's only inconvenience is that you have to open KeePass, wait ~5 seconds, then you can it automatically go to a website and enter your username and password. It's worth it for making 32 character unique passwords for all your websites.

I don't have much experience with lastpass, but from a security standpoint, it looks pretty similar to keepass. I don't know how the synchronization is done, there could be a security flaw there, but probably only if it's done through some centralized lastpass servers.