Hacker News Reader

Comment by ploggingdev | Hacker News Reader

> 1. Have a really, really good password, and change it often.

Even better, use a password manager.

> 2. If possible, use a separate computer (an old one or a cheap one purchased for this purpose) for things like banking; if your family computer is the same one that you use for bank transactions you risk having your kids click on a bad link that results in a hacking.

Not necessary, use an up to date computer with Windows defender turned on and create a non-admin account for your kids.

> 4. Have antivirus software on your computer

Only use Windows defender, which is what the security community recommends.

Also use 2FA on all services which offer it.

Regarding the domain registrars, I would recommend Namecheap. They have a great support team and also offer 2FA, but I think it's only SMS based 2FA.

View on HN

I really wish domain registers offered a Google Authenticator option for 2FA. All of the ones I have seen that offer 2FA are SMS based.

SMS is far better than nothing. Your average script kiddie is not going to be able to intercept your SMS messages. If you are specifically targeted by sophisticated attackers, maybe.

My biggest gripe with SMS 2FA is that it is prone to locking me out of my accounts on travel, if I suddenly need to log in to something and my phone number isn't the same abroad.

is it such a pain taking a small burner phone? Alternately, you can install 2FA app in your smartphone. And if you traven that frequently you need to revisit your security choices. There is no security without any efforts from _you_. Google/MS/Apple can only do so much.

They'll just social engineer your carrier into the transfer of your phone number to a different SIM card

Is it only me who is surprised that in the US no one has the notion of buying pre-paid SIM cards - which are unconnected to your SSN or credit card or bank account?

https://www.name.com lets you use Google Authenticator for 2FA.

https://www.gandi.net/ does as well and has been pretty great in my (somewhat limited) experience.

http://www.namecheap.com offers their own 2fa service, as well.

Yeah, that's the point. Everyone tries to re-invent 2FA or use SMS, both of which are bad for the end user. Even 2FA companies like Duo use some non-standard protocol which only their client can implement.

https://www.dynadot.com offers both Google 2fA and SMS, with a big push toward the Google solution. Dynadot has been a great all-around solution in my experience. Gandi is also excellent.

Of my registrars, Namecheap does not but Gandi.net and Hover.com both offer the standard TOTP option.

PairNIC (https://pairnic.com) now offer TOTP 2FA (use Google Authenticator or whatever else you want).

www.nearlyfreespeech.net (mainly a host but you can register domains with them) offers Google Authenticator 2fa and control over what recovery options are allowed, including none, which is something I wish anyone that supports 2fa would offer.

Just another happy customer giving those guys a big thumbs-up!

NFS also emails you if someone tries an incorrect password on your account. Kind of a nice feature.

name.com offers a choice between Google Authenticator and SMS for 2FA.

siteground.com

hover.com offers both SMS and TOTP (authenticator).

I use Google: https://domains.google.com

If only it were available in Germany. :(

Amazon does ..

Hover supports 2FA with authenticator apps.

Is there an industry favorite password manager these days? Every time I read something like this I re-commit to getting a manager, but then I can never decide on a product. I just want something that's secure and preferably non subscription-based.

I like keepassx. It just works and no need for any online account. You use a good master key/password and rest of the passwords, don't even remember.

How do you personally handle passwords on multiple devices? Just host it somewhere publicly accessible and use a really strong master?

I use Tresorit (https://tresorit.com) to sync across machines and phones.

My setup is to store the database itself in a cloud storage service that supports 2FA like Dropbox, and encrypt it with a file/password combo key. The key file I manually copy to every device I use, and the master password is stored in my head.

This way it's safe to store the database in the cloud without having to worry about attackers trying to brute force my master password if Dropbox gets compromised (since they'd also need the key file, which is only stored locally), and even if the key file is stolen the attacker would still need my master password to access the database.

+1 for keepassx. I use it on all platforms (well, keepass droid too). All passwords are randomly generated except the one for the keepassx db (and that also needs the key file).

And keepass has also (some sort of) 2FA via a local key file. While it's of course not as good as a real token generator, it helps against password sniffing and makes cracking much harder.

At least in the security circles I'm in, 1Password is the favorite.

KeePassX is recommended sometimes too, but is definitely for the more technically-minded.

There's a low level of distrust for Lastpass.

I'd love to use 1password still, but they have no Linux client (even cli), the web client is long gone, and the Android app is awful.

It's really great software, but I don't feel valued as a customer at all.

Did they really get rid of the web client? Last I checked they were moving toward the subscription base model and I thought that was more web-centric than the buy-once-and-forget-it version that I'm using.

Web client absolutely exists for subscribers to their syncing service.

Really? That's great news, I only found information about the ancient one that was special-cased in dropbox. I can't even see mention of it on the 1Password website, but as there's a free trial it seems low risk.

What about KeePass2?

KeePass is an open-source password manager. There are many compatible programs, many with confusingly-similar names, like KeePassX. KeePass2 is the new version of KeePass, which uses a new file format. Most KeePass-compatible programs, including KeePassX, support the old file format and the new one.

Sure, but why prefer say KeePassX over KeePass2?

Unless they know something I don't, I assume people recommending KeePassX are not Windows users.

I use KeePassX, no complaints, no 'official' browser extensions not that I'd use one if there where.

Just a data point: 1Password, in the standalone native app version, is the only password manager I recommend.

The other popular one here seems to be keepass. Do you have technical concerns with it, or is it just too user-unfriendly compared to 1Password?

See http://www.infosecisland.com/blogview/21776-KeePass-Vulnerab... and https://www.engadget.com/2016/06/04/keepass-wont-fix-securit...

I migrated from lastpass to https://www.enpass.io/

It is a cross platform PW manager with Browser extensions (i only use it on macOS with FF and Chromium, though), which does NOT store your passwords in the cloud.

You can sync the database via Cloud storage providers/webdav/usb stick. I really like to be in control of where my passwords are stored.

Sharing of passwords (business usecases!?) is not supported afaik.

I use iCloud Keychain. Works well as long as you use safari, which is admittedly uncommon.

Yeah, I tried really hard to make Safari my default browser in order to use keychain. Keychain itself was great, but safari just didn't cut it for me. Their devtools equivalent is terrible, and I didn't like running two browsers. I was bummed to lose keychain, though.

Huh, I find safari's devtools much more useful than Chrome's, though I admit I am more used to it. What annoys you about Safari's dev tools?

See I was all for 2FA, but there were a number of high profile heists that actually used 2FA to gain control first of your mobile number, then email, then anything else they valued. Since mobile operators care even less then hosting companies, I am not sure having 2FA with sms code to be a good security practice.

I do have yubikey keyfob but sites that are supporting it are very few unfortunately. Gmail being one, which is great.

Many don't consider mobile phone two-factor authentication as real two factor authentication. The reason being is that while the phone looks like "something you posess" it is really just an interface for another "something you know" which is your phone account information. As you said, this info can be compromized to intercept or take control of your SMS.

Real 2FA uses a token generator device or an app like google authenticator which does the same thing. This is a real "something you possess" as it can't be compromized without getting access to the device.

The article is sparse in details. Which email service did she use? did she get any phishing emails?

> > 4. Have antivirus software on your computer

> Only use Windows defender, which is what the security community recommends.

Just don't use windows.

Reply on news.ycombinator.com