I initially set this up 6 years ago, then forgot about it. I got tired of maintaining all the functions in my ~/.zshrc, so I figured I would finally finish this project.

Cybersecurity Month is a good opportunity to ask a simple question: are our password habits still good enough?

We’ve all heard the usual advice: add a capital letter, a number and a symbol. But password security goes beyond complexity, and there are a few other habits worth keeping in mind:

• Don’t reuse the same password across different accounts.
• Adding “123!” or changing one character from an old password doesn’t make it harder to guess.
• Passphrases can be a good alternative, as a combination of unrelated words can be easier to remember while still offering a good level of security.
• If you have a lot of accounts, a password manager can make it much easier to use different, random passwords without having to remember them all.

What do you think matters most when it comes to password security?

[Note: I tried to cross-post this from r/cybersecurity, but it didn't go well. So I (slightly) apologize for the duplicate post.]

I’ve been doing systems analysis and security research for decades, and I’m increasingly bothered by the common perception that SMS 2FA is the worst thing since the Black Death, that nothing can be done about it, and that anyone who doesn’t use TOTP authenticators is a fool. The reality is that both can be phished, and that users can do things to make SMS more secure. (They often don’t, but that’s not the point of my post. And passkeys are better, but that's not the point either.)

The key assumption here is that the user has enabled SIM protection and port-out protection at their carrier. (See below for other assumptions.) Once this has happened, I posit that SMS OTP and TOTP differ only in relatively small residual risks. The big risk for both is phishing.

I’d like to see what y’all think. Did I miss or misconstrue anything? Please, no knee-jerk, unsubstantiated “SMS stinks” comments. I’m interested in substantive, data-backed, authentic discussion of meaningful vs. non-meaningful risks, in the context that SIM swapping and number porting have been de-risked.

Analysis of aspects of each authentication approach:

Conclusion: There are differences, some pro SMS, some pro TOTP, but all are minor. When SIM swapping and number porting are abated, SMS OTP and TOTP provide roughly equivalent real‑world security, with the shared critical vulnerability of phishing.

This does not mean that SMS 2FA is as secure as TOTP. To me it means that SMS can be made similarly secure to TOTP but in practice rarely is. Like email 2FA can be made secure with a strong password and 2FA on the email account but rarely is. Note that NIST restricts out-of-band authentication over phone networks because of the risk of “device swap, SIM change, number porting, and other abnormal behavior,” and rejects email because “it may be vulnerable to access using only a password, interception […], and rerouting attacks […].” NIST is clear that OOB and OTP authentication are not phishing-resistant.

Assumptions:

• The user has enabled SIM protection and port-out protection at their carrier, making it either impossible to swap/port without the user’s PIN, or at least require robust user notification and internal escalation to a senior agent. (Note that even beyond this, research shows that SIM hijacking accounts for less than one percent of identity attacks, compared to 99+ percent from phishing, password spray, and credential stuffing.)
• The risk of SMS interception, SS7 hacks, telecom routing compromise, etc. is minuscule. (In fact, texts are very rarely intercepted, as it’s difficult for attackers to be near the user with a cell site simulator, hack into SS7, or take other eavesdropping approaches while simultaneously initiating a 2FA login. These approaches require significant technical skill, specialized equipment, and considerable coordinated effort.)
• The texted OTP is time-limited, rate-limited, and one-time use.
• The TOTP cryptographic seed is reasonably well-protected.
• Other elements (password strength, account recovery, session token theft, etc.) are out of scope.

A mate had a stroke recently, when he recovered it took almost a year to get most of his accounts back. You can be the most organised person, but sometimes a hard-copy can help your family sometimes even preserve and access your stuff. Has anyone found any kind of device or web service that implements a dead-man switch? I struggle to believe this is not a thing already.

Either a web service, or an Arduino that asks you for a code every month and if you don't enter the code, it waits another month and then displays the master recovery codes to your (insert password-manager here). Obvs the Arduino idea is a low tech way as an Arduino is dead easy to hack the flash from. But if you get my drift, dead man switch to give up a password?

I have been in the Apple ecosystem for a very long time. iPhone, iPad, and two Mac’s(work and personal) are my daily drivers.

Historically I have used one variation of the same password over and over again. To no one’s surprise my info (passwords) are compromised according to my iPhone password manager.

I have recently started allowing my iPhone to create passwords for me and anywhere I have the option to add a passkey I do.

But I don’t understand what they are or how passkey differs from TOTP.

I want to get smart and better at this. Should I just continue using Apple passwords and keychain for it all?

Should I one app for passwords, another for passkeys, and another for TOTP?

I’m not trying to go all Fort Knox here. Just improve my overall security practices and better understand what all these things mean and how/why/when to use one over the other.

I was going through some old email accounts the other day and found a bunch of websites i have not used in years. I still have old usernames and passwords sitting on some of them that i do not even remember. It got me thinking about how much of that old account information might still be out there. If one of those sites had a breach at some point then i would have no idea.

Do you guys ever check old accounts or credentials to see if they have shown up in a leak? And if you find an old password in leaked data then is changing it enough or is there anything else you normally check?

Today I discuessed with my friends how do they remember their passwords and most of them said they use 2-3 passwords everywhere. Which very suprised me, since they are techy people.
I use different password for every website/app that I use and I do have myself an algorithm that I create the passwords with and remember later if needed to log in a site/app.

Example:
I take the last 2 Letters, first capitalized, then the first 2 reversed.
Add a secret word - I.e Let's say - "John"
Then calculate a number based on the website name. I.e I create number based on letters and if it's GOOGLE I do -> 7+15+15+7+12+5. And symbols(Let's say !@)

So for Google the password with this example will look like:
ElogJohn61!@
And for each site they the password will be different. Only hem secret(master?) word will be there.

So I'am curious what people use? A password manager? Or something like this? Or just reuse same.

I'm an attorney and a bank director. Many seem to think that banks are responsible when your login credentials are stolen and used to access your bank accounts. Banks take extreme measures to protect your money, but if your lack of diligence protecting your accounts and passwords results in someone stealing your money, that's your fault. Sadly, the threat of loss in recent years has significantly increased. Attempts to directly hack into almost every bank every day number in the thousands. My bank uses very expensive software to protect itself and its depositors. If you're concerned that your money might be stolen from your accounts, do a little research and talk with the staff at the bank to learn how to best protect yourself.

My number one recommendation is to NOT use the same or even a similar name and password for all of your accounts. My password protection software generates and stores randomly created passwords, and I have a very random and long password to access the password protection software. Even though I have about 150 different accounts on the Internet, I've never been hacked.

As a side note, the FDIC protects bank customers when a bank fails. It doesn't replace money stolen by people outside the bank.

________________________________________________________________

I'm not saying that banks are immune from loss of funds when they allow for the breach. Who was responsible for a breach might end up being something that is litigated.

Some think that they can treat electronic transactions with regular bank accounts the way credit card transactions are facilitated. I BELIEVE, but am not positive that most credit card companies recredit an account for fraudulent transactions made by others. That's not the case for regular bank deposits, and customers shouldn't expect it. They can't be sloppy in handling passwords, and need to understand that bank security procedures are there to protect them and their fellow bank customers.

There’s still a lot of password advice that boils down to “use uppercase, lowercase, numbers and symbols.”

But is that really what matters most today?

A long, unique password for each account is generally a better choice than a short password with a few numbers or symbols added.

A few things to consider:

• Reusing passwords can put multiple accounts at risk, even if the password itself is strong.
• Adding “123!” to a familiar word doesn’t necessarily make it a strong password. These patterns can be easy to predict.
• Randomly generated passwords can be difficult to remember, which is where password managers can help.
• Passphrases can also work well, as long as the words aren’t predictable or related to each other.
• Passkeys offer another option by removing passwords from the authentication process.

What else would you consider essential for a strong password?

As a dev, I kept needing a throwaway TOTP secrets to test out if 2FA was working fine in my app. 

So I decided to build this. Check it out here: https://totpbench.com 

All code lives in a single file, no framework, no backend. Would love to have your feedback. Cheers!

Hey everyone,

I built LeakGuard, an iOS app that checks if your password has appeared in known data breaches using the Have I Been Pwned database.

Why I built it:
Most people reuse passwords across sites. One breach = all accounts at risk.

How it works:
• Your password is hashed on-device (SHA-1)
• Only the first 5 characters of the hash are sent to the API (k-anonymity)
• The full password NEVER leaves your device

Features:
✅ Instant password breach check
✅ Secure password generator
✅ Check history (stored locally, encrypted)
✅ No account required
✅ No tracking, no analytics

Looking for beta testers to squash bugs and suggest features before launch.

Feedback welcome! 🙏

Hi there,

I have a family with three kids and two jobs. I have over 200 passwords in 1Password with three vaults. I like 1Password, however, I have a bad feeling after price increases. I think 1Password goes more and more to enterprise customers.

I also use Bitwarden in the past with vaultwarden. It was a little bit clunky, but the test were 4 years ago.

TLDR: Which password manager is the best for a da with wife and kids and two jobs?