c/cybersecurity-tips

Pro tip: 2FA through text messages is basically useless now

I used to think that SMS two factor authentication was better than nothing and kept it on every account. Then my buddy Mark got his number ported out by some scammer who called Verizon pretending to be him. Took him 4 hours to get his line back and in that time they drained his crypto wallet and locked him out of email. I always thought SIM swapping was something that only happened to celebrities or rich people. Now I switched every account I can to authenticator apps like Authy or Google Authenticator instead. The extra 30 seconds it takes to open an app is way better than losing access to everything. Has anyone else had a close call with SIM swapping or am I just late to this party?

Got phished by a fake invoice 2 months ago - lost $800 before I noticed

That free password manager I ignored for years got me out of a bind when my laptop crashed last March

I always figured paying for Bitwarden was overkill until I needed to recover 47 logins from a dead hard drive and realized their free tier had everything backed up in the cloud the whole time - anyone else sleep on free tools that saved them later?

Lost $80 on a two-factor authentication key that wasn't compatible with my phone

I bought a popular hardware security key from a big electronics store last month without checking if it worked with my older iPhone SE. It turned out the key needed a USB-C connection and my phone still uses Lightning, so I couldn't even set it up. Has anyone else run into this compatibility issue with hardware keys and had to return one?

Shoutout to the IT guy at our office for his password advice

Our IT guy told me last year to never reuse passwords across work and personal accounts, but I blew him off. Then a random data leak from an old shopping site gave someone my login, and they tried it on my work email last Tuesday. Anyone else ever get burned because you didn't listen to simple advice from someone who actually knows their stuff?

My password manager failed me during a password reset yesterday

So I was trying to reset my email password yesterday morning because I forgot it again. I went to my password manager to get the old one and it just showed a blank field. No stored password at all. I must have missed saving it last time I changed things around. Then I tried to do a recovery through email but that failed because I couldn't get into the email. It took me 45 minutes of calling support and answering security questions to finally get back in. Now I'm paranoid and checking all my stored passwords to make sure they actually saved. Has anyone else had their password manager just lose a password out of nowhere? I'm using Bitwarden and this is the first time it happened.

PSA: That free VPN app I used for 2 years was selling my browsing data the whole time

A security engineer at a meetup last month showed me the fine print in the terms of service and I finally saw how they made money off my traffic.

Tried LastPass for 2 years then switched to Bitwarden and it's not even close

LastPass had a breach in 2022 and I still stayed, but when they capped free users to one device type I finally switched. Bitwarden cost me $10 a year and my autofill actually works on mobile. Anyone else make the swap and feel stupid for waiting?

My neighbor's kid explained phishing to me and I felt old

I was out front edging my lawn last Saturday when this 12 year old from two doors down came over and asked if my email was 'password1234.' I laughed and said no, but then he started talking about how his school taught them to spot fake login pages by checking the URL before the first slash. He showed me on his phone how a tiny spelling difference can trick people. Made me wonder if schools are actually doing a better job teaching this stuff than most adults learn on their own. Has anyone else had a young kid school them on basic security?

Shoutout to the guy who told me to stop using 'password' as my wifi name

I had a customer at my shop who pointed out my network was broadcasting my last name and model number of the router. Changed the SSID to something generic and turned off SSID broadcast after that, now I feel way less exposed.

My old router finally gave up on me mid-zoom meeting yesterday

Honestly, I was on a video call with my boss around 2 PM yesterday when my router just died. No warning, no flashing lights, just completely dead. I spent about 45 minutes trying to reset it and even called my ISP, but nothing worked. Ended up driving to Best Buy and grabbing a refurbished TP-Link for $35. It took me another 20 minutes to set it up, but at least I got back online before the meeting ended. Has anyone else had a router fail at the worst possible time?

Was skeptical about password managers until my bank account got hit

I used to think password managers were just another subscription to pay for. Then someone got into my old Yahoo account from a breach back in 2016 and used it to reset my Amazon password. Lost about $180 before I caught it. Now I use Bitwarden and it feels like a no-brainer. What made you finally give in and try one?

Password managers vs memory: After 3 password resets in one week I finally caved

I always thought I could remember my passwords just fine. Then I locked myself out of my bank account, my email, and my work VPN all in the same week. Got a free password manager from a friend who's in IT. Took me maybe 20 minutes to set up. Now I just click one button and I'm in everywhere. My old way was stupid. Why do people fight this?

Stumbled on an old stat about password length that blew my mind

I was digging through some old cybersecurity forums last night, you know the ones from like 2005, and I found a post where a sysadmin said his company required passwords to be exactly 8 characters with symbols and numbers. That was the standard back then I guess. But get this, he said they never had a single breach in 10 years with that setup. Now I look at my bank and they want 16 characters plus two factor, and I still get alerts about suspicious logins. Makes me wonder if we are overcomplicating things or if the bad guys just got way better. What kind of password rules does your job use now?

Can we talk about how much smoother my home network runs after I finally updated the router firmware?

I put it off for like 6 months because I figured it wouldn't matter, but after a kid in my crew told me his whole smart home went down from an old firmware bug, I did mine and my streaming hasn't buffered once since last Wednesday - anyone else see a big difference after a simple update?

Had a rough week after my credit card got skimmed at a Pilot in Kansas

Last Tuesday I stopped for fuel in Wichita and used the pump at the Pilot off I-35. Three days later my bank called asking about $400 in charges from some sketchy website in Malaysia. Now I only pay inside with cash or use a dedicated virtual card number for gas purchases. Anybody got a good way to check ATMs and pump readers for skimmers without looking like a weirdo?

Can we talk about the coffee shop Wi-Fi security issue

I stopped by a local coffee spot called Brew Haven near downtown last Tuesday. They have a sign saying 'Free Wi-Fi' but no password at all. I saw at least 6 people on their laptops including one guy logging into his bank. I get that they want it easy for customers but it's a huge risk with no encryption. I told the barista and she just shrugged said nobody complained before. Am I the only one who thinks cafes should at least put up a basic password for the network?

That free password manager I ignored for 2 years... finally tried it after a close call

I used to just save all my logins in my browser because it was easy... thought password managers were too complicated. Then last month I got a notification that someone tried to log into my email from a different state. That scared me enough to finally set up Bitwarden. Took me about 20 minutes to import all my passwords and set up 2FA. Now I see how weak some of my old passwords were, like using "password123" for my bank. Anyone else put this off and then wish they did it sooner?

Cloud backup I ignored for years saved my data after a ransomware hit

I always thought cloud backup was just another monthly fee that people paid to feel safe. My buddy kept pushing Backblaze on me for 2 years and I never bothered. Then last month a ransomware attack hit my home server and encrypted everything, including my local external drives. I had 4 years of family photos and client projects on there with no backup. I started looking into recovery options and realized how screwed I was. After that I signed up for Backblaze at $9 a month and now I sleep way better. Has anyone else here dodged a bullet after ignoring backup advice for too long?

Hot take: That guy at the coffee shop fixed my password problem in 2 minutes

I was at a local roastery last Tuesday, fumbling with my phone trying to log into my bank account after I forgot my password again. This older guy next to me just said "use a passphrase, not a password" and walked me through it. He showed me how to pick five random words like "purple goat spoon river lamp" and now I remember everything easy. It took less than a minute and I haven't locked myself out since. Has anyone else tried this trick or do you stick with something different?

Finally switched to a password manager after 3 hours of resetting logins

I used to think password managers were overkill. Then last Tuesday I spent three full hours clicking 'forgot password' on 14 different accounts because I couldn't remember which variation of my usual password I used. It was a bank, my email, a streaming service, even my work login. That time sink finally convinced me to try Bitwarden. I got it set up in maybe 20 minutes and now I just let it generate random strings. Has anyone else had a moment where a single frustrating experience pushed them over the edge into better security habits?

Overheard my neighbor bragging about his 'unhackable' smart lock at a BBQ

So I'm at a cookout last Saturday and this guy starts going on about how his new smart lock is impossible to break because he uses a 12 character password. I asked him if he had two factor auth turned on and he gave me this blank stare. Then he said he doesn't need it because his password has special characters. I didn't want to be rude but I had to explain that his password sharing habit with his kids and their friends basically makes all that moot. Its like locking your front door but handing out copies of the key to everyone in the neighborhood. Has anyone else run into people who think a long password is a magic shield against everything?

The morning I accidentally leaked a client's password list changed how I handle data

Back in February I was training a new client and left my notebook with 30 client passwords sitting on a bench at the YMCA for about 15 minutes before I realized it was gone. A woman found it and returned it to the front desk, but it scared me enough that I spent that entire weekend moving everyone to a password manager like Bitwarden. Has anyone else had a close call with physical data that pushed you to finally go digital?

Appreciation post: that moment I learned most data breaches start from phishing emails, not hackers.

I read a report from Verizon last month that said over 90% of data breaches start with phishing and it actually surprised me since I always thought it was guys breaking into servers, has anyone else seen numbers that changed how you think about staying safe online?

I ignored two factor auth for years until it bit me at a coffee shop

Last Tuesday I was at a Starbucks in downtown Austin checking emails on their wifi. Got a notification that someone logged into my bank account from a phone in Nigeria. I froze for a solid 30 seconds before realizing I left my bank account without any extra security. Spent the next hour on hold with their fraud department while the barista asked if I wanted a refill. They caught it fast because the login was from an old device they flagged, but I lost access to my account for 3 days while they reset everything. All because I kept thinking two factor was too annoying to set up. Has anyone else had a close call that finally pushed them to lock things down?