this post was submitted on 09 Jul 2023
10 points (100.0% liked)

/c/cybersecurity - Cybersecurity News & Discussion

2111 readers
1 users here now

A community for technical news and discussion of cybersecurity and closely related topics.

founded 4 years ago
MODERATORS
 

Ever since the Lastpass breach (thankfully moved to Bitwarden and recycled passwords prior) I've had a heightened awareness of the potential for vulnerabilities beyond my paygrade leading to online catastrophe for me. I use Bitwarden to generate a random password for all sites.

If it's something which could truly cause a headache such as my email or banking however, I'll usually append the domain name, or a word, or a symbol to the password such that after my phone or PC's Bitwarden autofill enters the saved password I also need to enter whichever word or symbol for the site. Feels like this gives me some defense if people smarter than me made a mistake, but I guess I have questions for folks who know about hashing/blackmagic/thecyber.

  • Would this have any benefit, if one were to put "google" at the end of their Google password, as far as protecting from a password manager exploit?
  • No, I don't actually put google or reddit at the end of my password; oops not a question
  • Is that already something baddies would know to try? Or did I just play myself by posting this on the internet?
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 4 points 1 year ago

Yes, it is something "baddies" would know to try... but most likely wouldn't.

Your passwords are at risk from:

  1. Using an easy password like "1234"
  2. Reusing the same password from a site where it got leaked
  3. Capturing your password manager's master password
  4. Somehow else accessing the decrypted password database
  5. Directly capturing whatever you type in the password field
  6. Drugging and torturing you until you tell the password

Your strategy only enhances your security in case 4, where someone would somehow manage to get your unique site password without compromising your system.

Otherwise, you're compromised with or without it: in cases 1 and 2, it's your fault; cases 3 and 5 are basically the same case, you've got your system compromised and the attacker can capture whatever you type; in case 6, you're in bigger trouble already.

The likelihood of case 4, is relatively low, since the other cases are easier and/or more effective.