News for hackers. Stuff that matters.

A comment on Password Managers: Under the Hood of Secrets Management. Parent comment

Re:Password Managers: Under the Hood of Secrets Management by phyller on Wednesday February 20, 2019 @05:38PM (#19212792)
The problem is 200 passwords being compromised, including my emails which are used to reset everything else. I can't fix it faster than the thief can wreck my digital life, and everything is digital now. I couldn't even start until I somehow convince my email provider who I am and to change the password for me.

If this ever happens, best plan would probably be to change your email password immediately, banks next, and freeze your credit as soon as possible.

[ Parent | on HN ]
Re:Password Managers: Under the Hood of Secrets Management by pvg on Wednesday February 20, 2019 @06:27PM (#19213143)
A better, simpler-sounding plan is to enable better 2FA on your critical accounts. Doesn't this mostly fix your catastrophic scenario?
[ Parent | on HN ]
Re:Password Managers: Under the Hood of Secrets Management by graeme on Wednesday February 20, 2019 @08:52PM (#19213873)
Oftentimes 2fa backup codes are slso stored in the password manager.
[ Parent | on HN ]
Re:Password Managers: Under the Hood of Secrets Management by spydum on Wednesday February 20, 2019 @09:11PM (#19213961)
Or the password recovery for lost 2fa is secret questions (this is so awful,but see it often). And chances are those secret questions/answers might also be in the vault
[ Parent | on HN ]
Re:Password Managers: Under the Hood of Secrets Management by graeme on Wednesday February 20, 2019 @09:37PM (#19214066)
Does anyone have a good solution to these issues for non techncial users? 1password etc + 2fa is great for even not super technical people.

But if it's ever breached I have no idea how you would get clear.

[ Parent | on HN ]
Re:Password Managers: Under the Hood of Secrets Management by pvg on Wednesday February 20, 2019 @09:42PM (#19214090)
Sure but that's roughly equivalent to disabling or not having 2fa. You can still avoid the catastrophic scenario by not-doing that.
[ Parent | on HN ]