The Design Community Hub

c/cybersecurity-tips

8

miller.paul•25m ago

I used to run every password through a random generator then realized I was the weak link

Back in 2019 I was using a password manager with 20 character random strings for every account. Problem was I kept resetting passwords because I could never type them right on my phone or work computer. A security auditor I worked with in Chicago pointed out that 14 character passphrases with real words are actually harder to crack than random gibberish. Switched to diceware style phrases about 2 years ago and my reset rate dropped to zero. Has anyone else found that convenience and security don't have to fight each other?

11

miles_jackson9•1d ago

Got hit with ransomware last week - lost 2 years of client photos

Opened what I thought was an invoice from a regular client. Boom. Every file encrypted. 2019 to 2021 wedding photos gone. Had to pay the bitcoin demand just to keep my business alive. Anyone else been burned by this exact trick?

26

barbara429•1d ago

TIL that "123456" is still in the top 10 most used passwords in 2024

My cousin Dave swore his "super secure" password was fine for years - then his email got hacked last Tuesday and someone tried to buy $400 in crypto with his PayPal. Has anyone else had to deal with a relative who refuses to use a password manager?

32

verac49•2d ago

Back in 2019 at a coffee shop in Portland I saw someone get their whole laptop locked up

Honestly, I was just waiting for my latte and this guy next to me clicked a link in a sketchy email. Within seconds his screen went black with a ransom note demanding $500 in Bitcoin. That moment made me finally set up 2FA on everything and I still think about how fast it happened. Has anyone else had a close call that made them change their habits?

18

kim.hannah•2d ago

Unpopular opinion: those password strength meters on websites are totally lying to you

I tested my "strong" password on a public checker last night and it cracked in under 2 seconds because it was just a common word with a number at the end, so why do we keep trusting those green bars?

13

mila_jones39•2d ago

Coworker told me my passwords were way too simple and I felt dumb for a week

Honestly, I used the same password for like everything for years. A guy in IT at a coffee shop in Denver pointed out I was using my dog's name with a 1 at the end. I changed to a password manager after that and now each site has a totally random 16 character string. Has anyone else had a wake-up call like that from someone random?

25

danieljenkins•4d ago

That time an old coworker showed me his password notebook

Back in 2018, I had this coworker named Phil who must have been in his 60s. He kept a little spiral notebook in his desk drawer with all his passwords written down, and I mean every single one for every site he used. I asked him about it once and he just laughed and said 'been doing it this way since 1995, never got hacked once.' It kind of stuck with me because here I was using a password manager and still getting phished twice that year. Has anyone else met someone who does the analog thing and actually makes it work?

12

emma_ramirez•5d ago

Vent: Spent $80 on a password manager and my mom still uses sticky notes

I paid for a year of Bitwarden premium to get the family plan. Set everyone up with strong passwords, two-factor, the whole deal. My mom printed out her login info and taped it to her monitor at home. She says it's faster than opening an app. Meanwhile my work emails got hijacked last month because I reused a password from 2016. So here's the debate: is paying for password managers actually worth it when the weak link is always the person typing them in? Or should companies just accept that most people will never change? I'm torn between forcing everyone onto biometrics and just giving up.

18

wyatt_fox68•5d ago

Caught a phishing link at a coffee shop in Denver last month

I was at this place called The Weathervane Cafe in Denver last month working on my laptop. Someone on the same wifi got a text that looked exactly like their bank's login page, even had the right URL at first glance. I saw them type in their password before I could say anything. That night I changed my own home setup to block sketchy redirects through my router. Anyone else had close calls in public wifi spots?

8

blair_dixon•8d ago

Just found out 90% of data breaches come from phishing emails, not hackers breaking in

I was reading through Verizon's 2023 Data Breach report last night and that stat jumped out at me. I always imagined some dude in a hoodie cracking passwords, but nope, it's mostly people clicking bad links. Makes me wonder why we spend so much on firewalls when the real weak point is the person sitting at the keyboard. Has anyone else changed their training approach after seeing numbers like that?

5

fiona_murray•9d ago

Just wasted 4 hours chasing a DNS issue that turned out to be a forgotten VPN connection

My site kept timing out and I tried flushing caches and changing settings for hours before I noticed my VPN was still on from a client call - has anyone else had something this basic trip them up?

11

noahw53•11d ago

Just got hit by a fake Microsoft support popup that looked legit

I was working on tenant paperwork yesterday morning and a full-screen alert popped up claiming my Windows license expired. Had to force restart to get out of it, and then found three sketchy browser extensions installed after. Anyone else seen these popups mimicking the real Windows UI lately?

2

emma_young•11d ago

Just realized I’ve been using the same password for 12 years across 30 accounts.

I only caught it when my email got hacked last Tuesday and someone tried to order $400 worth of protein powder to my apartment, and now I’m resetting everything with a manager at work tomorrow, has anyone else had to deal with the fallout from something this stupid?

3

susanm22•12d ago

Am I the only one who still uses old-school password notebooks?

I remember back in 2010 I used to write down all my passwords in a little spiral notebook. But last year I realized that was a huge risk after my cousin found it at a family dinner. So I switched to using a free password manager called Bitwarden. It took me about an hour to set up all my accounts, but now I don't have to worry about losing that notebook. Has anyone else made the switch from paper to digital and found it tricky to get started?

11

bailey.sandra•13d ago

My home server crashed 3 times in one week and I finally set up a proper backup routine

After losing a week's worth of Plex metadata and some family photos, I bought a 4TB external drive for $89 and spent my Saturday automating nightly backups with rsync, and has anyone else found that small projects like this end up teaching you more than the big ones?

28

margaret_lane•14d ago

Vent: So many people still reuse passwords across sites

My buddy at work just had his Spotify account taken over. Simple stuff. Password from a 2015 LinkedIn breach. He used the same password for his email too. Took them 10 minutes to lock him out of everything. I asked him why he didn't use a different password. He said 'it's too many to remember'. Doesn't know about password managers. Kept telling him for 2 years. Anyone else deal with people ignoring this until it's too late?

0

the_patricia•14d ago

Paid $40 for a password manager and it just saved me from a total mess

I dropped $40 on a password manager last month after getting tired of using the same password for everything, then yesterday I got an email from a site I used in 2019 saying they had a data leak. The manager auto-generated a strong password for that account and I realized if I hadn't switched, my bank login would've been compromised too. Has anyone else had a cheap subscription pay off big time like that?

22

margaret_lane•15d ago

Rant: Coworker told me to use the same password for everything

My buddy Dave at the office kept saying I should just use one easy password for all my accounts to save time. I tried it for about 3 months until someone phished my work email through a fake login page. Then they got into my bank account because it was the same password. Cost me $200 in fraud fees before the bank refunded it. Has anyone else had a coworker give terrible security advice like that?

30

wadeyoung•17d ago

Unpopular take: turning off two-factor authentication helped me more than it hurt

I know everyone preaches 2FA as the holy grail, but after my phone died at a coffee shop in Austin last week and I got locked out of my email for three days, I started rethinking it. The recovery process was a nightmare because my backup codes were in my house, and I was 500 miles away. I switched to a hardware security key instead and honestly it's been smoother. Has anyone else found 2FA through SMS or apps to be a bigger hassle than it's worth in certain situations?

15

reeseanderson•19d ago

PSA: That phone call from "tech support" almost got me

Had a chat last week with my mom's neighbor, a retired IT guy, about those scam calls everyone gets. He told me he almost fell for one where the caller knew his exact ISP and last payment date. That hit different because I realized they're not just fishing anymore, they're using data from breaches to sound legit. He said the key is to hang up and call the company back on a number you look up yourself, not the one they give you. Has anyone else noticed these calls getting way more personal lately?

-2

adams82•20d ago

Got hit with a fake invoice scam at my office in Denver last Tuesday

Someone sent a PDF that looked exactly like our regular office supply bill but with a different bank account number. I almost paid $850 before noticing the email domain was off by one letter. Now I always verify any payment change by calling the vendor directly. Has anyone else had close calls with invoice fraud?

3

rose_murray•21d ago

Hot take: password managers aren't as safe as we think

I used to think LastPass was fine until my cousin's account got hit in that 2022 breach. Now I'm debating between going back to paper passwords or trying a different manager - what do you all think?

23

grant.kevin•23d ago

Bought a $40 used router from a garage sale and it had a rootkit installed from the factory

The previous owner had no idea, but the firmware was hacked to send all their traffic through a server in Russia - how do you check used networking gear before plugging it in?

21

barbara429•25d ago

Learned the hard way that my router's admin page was wide open

Last Tuesday I was checking my home network and noticed some weird traffic in my firewall logs. Turns out I left the default admin password on my router for 3 years without thinking about it. Someone had been poking around trying to get in, but my ISP's basic protection blocked them. I changed it to a random 20-character password and turned off remote access right away. Has anyone else found scary stuff in their logs after ignoring their router settings for too long?

15

nora735•26d ago

Almost fell for a phishing text pretending to be my bank last week

I was at the grocery store checkout when I got a text saying my account was locked and to click a link to verify. The URL looked off by one letter so I called my bank instead and they confirmed it was a scam. Has anyone else gotten fake texts from numbers that look legit?