[minimalist]

This is a problem that's all too common on Hack Forums: members treating the 2FA account protection feature as surefire way to protect their accounts from theft and unwanted misuse. With the events from a month back and some recent occurrences, I thought that everybody should remember that 2FA is just an added layer of security. It does not protect your account against hijackers, and there are probably some things that are wrong with the system.

Your passwords on every site should be different (in an ideal situation), and your usernames should be as well. Either can be generated by yourself or a machine, but god damn...don't make it simple. These steps of caution will aid in protecting against bruteforce and data leaks, the most common points of failure that I've observed.

So...once again, don't treat 2FA like a system that'll defend your account every time. Because it's not.

[Armada]

Agreed.
2FA is added security, but CAN be defeated.
Its not a fail safe 100%, however one of the best tools we got.

[Cryptic™]

Your passwords on every site should be different (in an ideal situation), and your usernames should be as well. Either can be generated by yourself or a machine, but god damn...don't make it simple. These steps of caution will aid in protecting against bruteforce and data leaks, the most common points of failure that I've observed.

A lot of ppl tend to use the same or similar passwords for each site because they don't wanna use remember tons of different passwords.

It's best to use software like 1Password or LastPass that store your logins for every site, encrypt it, and you can protect your 1Password/LastPass with 2FA.

https://lastpass.com/ They have a chrome extension/desktop client/andriod/iphone client.

If anyone wants a free month of premium PM me. Premium lets you use it on your mobile device.

[Light]

A lot of ppl tend to use the same or similar passwords for each site because they don't wanna use remember tons of different passwords.

It's best to use software like 1Password or LastPass that store your logins for every site, encrypt it, and you can protect your 1Password/LastPass with 2FA.

https://lastpass.com/ They have a chrome extension/desktop client/andriod/iphone client.

If anyone wants a free month of premium PM me. Premium lets you use it on your mobile device.

I'm actually paying yearly for their premium service, love it.

[Omniscient]

The best security is very very simple.

1. Don't download.
2. Don't visit untrusted links.
3. Use unique passwords on each site that are at least 12 characters with numeric/upper+lower alpha and special characters if the site allows it.

2FA adds to that very simple formula.

[Armada]

A lot of ppl tend to use the same or similar passwords for each site because they don't wanna use remember tons of different passwords.

It's best to use software like 1Password or LastPass that store your logins for every site, encrypt it, and you can protect your 1Password/LastPass with 2FA.

https://lastpass.com/ They have a chrome extension/desktop client/andriod/iphone client.

If anyone wants a free month of premium PM me. Premium lets you use it on your mobile device.

That is actually a fantastic idea.
Also many AVs offer a Pw safe option. Kaspersky does for sure.

[Cryptic™]

I'm actually paying yearly for their premium service, love it.

I've been using LastPass for years. Awesome product.

It's $12/year. Or if you refer someone, you both get a month free.

For the past 2 years I just post in the small rewards/favors section and pay ppl like $0.25-$0.50 cents to use my referral and pretty much get the year for $6 or less.

Thanks to lastpass my passwords on every site are randomly generated (example '@0mp42O0fNHRg$ePbWI0' ) or longer.

[Mr Kewl]

A lot of ppl tend to use the same or similar passwords for each site because they don't wanna use remember tons of different passwords.

It's best to use software like 1Password or LastPass that store your logins for every site, encrypt it, and you can protect your 1Password/LastPass with 2FA.

https://lastpass.com/ They have a chrome extension/desktop client/andriod/iphone client.

If anyone wants a free month of premium PM me. Premium lets you use it on your mobile device.

There have been cases such sites getting hacked and their Db getting leaked. I'm very skeptical using online tools and resources.

[Retribute]

There have been cases such sites getting hacked and their Db getting leaked. I'm very skeptical using online tools and resources.

I agree. I would never trust sites like that.

[Port 22]

I'd recommend KeePass over LastPass, since KP doesn't connect to the internet at all. They also have a portable version. Also it's free.

[$lick]

The best security is very very simple.

1. Don't download.
2. Don't visit untrusted links.
3. Use unique passwords on each site that are at least 12 characters with numeric/upper+lower alpha and special characters if the site allows it.

2FA adds to that very simple formula.

1. Things can be downloaded without you knowing. (Drivebys/bloatware)
2. Ads and many other things can inject harmful code into websites that are legit.
3. Passwords can be recovered any number of ways. (Most malware tells you which website matches what password)

Any security can be defeated, there is no magic formula to keeping yourself safe.

The real answer is to do everything you can do and then just hope for the best, the harder you make it the less likely it will happen but... it will happen, maybe not to your HF account but to one of your accounts.

[Vicellus Drum]

The best security is very very simple.

1. Don't download.
2. Don't visit untrusted links.
3. Use unique passwords on each site that are at least 12 characters with numeric/upper+lower alpha and special characters if the site allows it.

2FA adds to that very simple formula.

My dad always said the best firewall/anti-virus was the human brain. Just a bit of logic, and you've got yourself a bulletproof setup.

[Armada]

My dad always said the best firewall/anti-virus was the human brain. Just a bit of logic, and you've got yourself a bulletproof setup.

My dad claimed the said BS until I gave him a virus to teach him the truth.
Common sense goes a LONG way, but software defensive help greatly.

Even I make mistakes, I can execute a viral binary just as easily as anyone. Id be absolutely fucked without my AV and malwarebytes.

[minimalist]

Do people really use a third party service to generate passwords for their online accounts? That's a concept that has never really made sense to me - I'll continue with storing passwords in my head.

[King Cin]

If you're not comfortable with storing passwords on a third-party program, write them down and put them somewhere safe.