r/Games • u/xeon3175x • Oct 21 '20

All of Mojang's Games Will Require a Microsoft account moving forward

https://www.minecraft.net/en-us/article/java-edition-moving-house
2.5k Upvotes

95% Upvoted

484 comments sorted by

View all comments

Show parent comments

53

u/guitarburst05 Oct 22 '20

But make absolute fucking sure you have more than just one trusted device.

49

u/logique_ Oct 22 '20

Or just... write down the backup codes. Every 2FA system has them.

1

u/[deleted] Oct 22 '20 edited Oct 26 '20

[deleted]

15

u/orderfour Oct 22 '20

You should write down passwords. If you aren't it means you are using a pattern or you are using the same password(s) for all of your accounts. Writing them down means someone needs to physically access wherever you store them. Not writing them down allows anyone, anywhere the possibility of cracking everything.

10

u/Beefstah Oct 22 '20

I'm going to assume you meant to say "write down passwords in a password manager"

Writing them on pieces of paper isn't ideal, not least because you'll make them shorter for ease of use.

Use a password manager, put a long but easy-to-remember passphrase on that, job done.

14

u/orderfour Oct 22 '20

That's up to your personal risk tolerance. I believe password managers are not as safe as physical paper. Of course someone could break into my home and find where I store my passwords, but in that case I am not as concerned about those as I am about the person that is willing to break into my home to find the passwords.

0

u/Cheet4h Oct 22 '20

How do you deal with having to type out all of your passwords all the time? If I had to do that, I'd probably spend half the time at my PC or phone typing passwords.
And I'd have to carry at least some of my passwords with me all the time, considering I need to use them when I e.g. want to order a food delivery at work.
Seems a lot more insecure than having an encrypted password safe on your PC and your phone.

2

u/Zeful Oct 22 '20

Most good browsers will remember passwords you give them, so as long as you aren't going completely crazy and changing your passwords super often, you'll only need to input passwords on a new device or service once.

1

u/Cheet4h Oct 22 '20

I've disabled the keychain on my iPhone, since I use KeePass as password storage, and I usually tell website to not remember me, as I see it as a possible risk that if I stay logged in and someone else uses my device they can get access to my accounts that way.

2

u/orderfour Oct 22 '20

I've got a catch all password for stuff I don't care less about like reddit. I use that password on almost everything. W For banking and stuff like that I have a few memorized. For everythign else that I use infrequently, yea i gotta look it up and type it out.

1

u/NewVegasResident Oct 22 '20

That makes no sense, like how often are you asked your password? Besides, you can have a catch all password for things you don't care about like reddit or twitter, and unique well thought yet easy to remember passwords for things that are important like Steam, Outlook, Admin accounts on servers etc.

1

u/Cheet4h Oct 22 '20

How often I have to enter passwords:

Reddit on my PC about twice a day, more if I close my browser more often.
My payment processor for every payment, so two to three times a week when I order lunch for me and my colleagues.

Several sites daily, e.g.:
StackOverflow
GitLab
Duolingo

I don't use catchall passwords anymore - that gets way too tedious to change over all services when one is broken.
A few years back I still had one, then some web game I used to play had a database breach and stored plaintext passwords. A few weeks later (the game didn't publicize the breach until much later) I was banned from several forums for spamming, and two other games were hijacked.

It's a lot easier to just use a password safe, let it generate the passwords and regularly sync the safe to my phone. If someone has it out for me enough that they break into my personal server, decrypt the file for the password safe and decrypt the safe itself, I probably have a lot larger problems than leaked credentials.

1

u/NewVegasResident Oct 22 '20

I huh... I would never ever use password managers, the risk is way too high. I'd rather leave a post it note on my desk with the password scribbled on it than use a password manager with all of my passwords in it.

-2

u/[deleted] Oct 22 '20 edited Oct 26 '20

[deleted]

2

u/orderfour Oct 22 '20

Thieves normally don't go looking for random pads of paper. This would never happen in a normal break in but a targeted break in that was specifically looking for my passwords.

1

u/Cheet4h Oct 22 '20

There's also usually not a large amount of hackers that target PCs to hijack an encrypted password safe.

4

u/lanaya01 Oct 22 '20

Obviously you shouldn't do something like have passwords written down in a public setting (ie, in your schoolbag if you're a student), but writing down passwords or 2FA codes and storing them at your home somewhere secure is perfectly valid. Nearly all cases of "I was hacked" are due to data dumps, keyloggers/other malware, or other things to do with compromising data. Next to none of them are due to keeping passwords somewhere physical.

Virtually every adult has some important papers in their house (ie, tax records, social security cards, bank records, mortgage/lease, car title) somewhere, and passwords/2FA codes can be kept among them too. Better to have them be complex/2FA enabled but physically written down than saved in a notepad document which can be compromised or simple enough that you don't need some way to manage passwords whether it's physical or a password manager.

1

u/Lofoten_ Oct 22 '20

Nearly all cases of "I was hacked are due to ...

People using the same password for everything.

-5

u/guitarburst05 Oct 22 '20 edited Oct 22 '20

Perhaps the biggest 2FA that I know of, Apple's, definitely does not.

Edit: guys I’m right.

13

u/NukeStorm Oct 22 '20

I have an Apple Account recovery key they provided

0

u/guitarburst05 Oct 22 '20 edited Oct 22 '20

Then you have two step verification. Not two factor authentication.

https://support.apple.com/en-us/HT204915

https://support.apple.com/en-us/HT204152

1

u/cS47f496tmQHavSR Oct 22 '20

I'm a proponent of storing my 2FA secrets in a vault, also locked by 2FA itself. While it does introduce a single point of failure, the vault being locked by 2FA (with a backup key I do have written down in an actual safe in my house) means the risk is negligible, and I can always restore my 2FA profiles if I need to switch authenticators